xml - How do I identify duplicate logs in Microsoft EventViewer using XPath 1.0? -
i have hundred of logs 1 follows. avoid displaying duplicates creating custom filter in eventviewer xpath 1.0, using text contained in [eventdata[data]] match pattern.
<?xml version="1.0" encoding="utf-16"?> <event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <system> <provider name="edi biztalk" /> <eventid qualifiers="0">0</eventid> <level>3</level> <task>0</task> <keywords>0x80000000000000</keywords> <timecreated systemtime="2013-05-15t10:45:07.000000000z" /> <eventrecordid>2369788</eventrecordid> <channel>application</channel> <computer>##</computer> <security /> </system> <eventdata> <data>some text ..</data> </eventdata> </event> this add when creating custom filter within event viewer:
<querylist> <query id="0" path="application"> <select path="application"> *[eventdata[data = following-sibling::data , not(data = preceding-sibling::data)]] </select> </query> </querylist> i have not been able so, syntax errors. can please provide examples?
thanks, ivo
use
suppress right below
select syntax remains same give in suppress wont appear. give try!
Comments
Post a Comment