New
#1
need task schedule with event data, not just ID for trigger
I need to differentiate two tasks that use the same event ID but data is different.
Any suggestions?
Thanks,
Ray
I need to differentiate two tasks that use the same event ID but data is different.
Any suggestions?
Thanks,
Ray
Here are the two events:
1.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="AudioSwitcher" />
<EventID Qualifiers="0">1</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-22T13:38:47.000000000Z" />
<EventRecordID>40684</EventRecordID>
<Channel>Application</Channel>
<Computer>TCVBD-2900-X4</Computer>
<Security />
</System>
- <EventData>
<Data>Speakers</Data>
</EventData>
</Event>
2.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="AudioSwitcher" />
<EventID Qualifiers="0">1</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-22T13:18:28.000000000Z" />
<EventRecordID>40679</EventRecordID>
<Channel>Application</Channel>
<Computer>TCVBD-2900-X4</Computer>
<Security />
</System>
- <EventData>
<Data>Headset Earphone</Data>
</EventData>
</Event>
I tried this xml filter:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[EventData[Data='Headset Earphone']]</Select>
<Select Path="Application">*</Select>
</Query>
</QueryList>
but it seems there was no filter
Help!
Thanks,
Ray