need task schedule with event data, not just ID for trigger

rnewman

New member
Member
Local time
1:00 AM
Messages
36
I need to differentiate two tasks that use the same event ID but data is different.
Any suggestions?
Thanks,
Ray
 

My Computer My Computer

At a glance

win7 home premium 64 bit
OS
win7 home premium 64 bit
Here are the two events:
1.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="AudioSwitcher" />

<EventID Qualifiers="0">1</EventID>

<Level>4</Level>

<Task>0</Task>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2014-04-22T13:38:47.000000000Z" />

<EventRecordID>40684</EventRecordID>

<Channel>Application</Channel>

<Computer>TCVBD-2900-X4</Computer>

<Security />

</System>


- <EventData>
<Data>Speakers</Data>

</EventData>


</Event>

2.


<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="AudioSwitcher" />
<EventID Qualifiers="0">1</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-04-22T13:18:28.000000000Z" />
<EventRecordID>40679</EventRecordID>
<Channel>Application</Channel>
<Computer>TCVBD-2900-X4</Computer>
<Security />
</System>
- <EventData>
<Data>Headset Earphone</Data>
</EventData>
</Event>


I tried this xml filter:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[EventData[Data='Headset Earphone']]</Select>
<Select Path="Application">*</Select>
</Query>
</QueryList>
but it seems there was no filter
Help!
Thanks,
Ray
 

My Computer My Computer

At a glance

win7 home premium 64 bit
OS
win7 home premium 64 bit
Back
Top