Getting Data In
Highlighted

Is there an easy way to access Microsoft specific folders for event log extraction?

Path Finder

I am trying to sort through certain event logs, and I am noticing that some I am searching for aren't under either System, Security, or Application. Instead, they reside under the Microsoft-specific event folders, such as Microsoft-Windows-ApplicationExperience/Program-Inventory. Is there an easy way to access these? I am already getting the Security, System, and Application ones through inputs.conf. Thanks.

0 Karma
Highlighted

Re: Is there an easy way to access Microsoft specific folders for event log extraction?

Communicator

Yes, use the same stanza definition you do for windows event logs using the objects full name as found in the properties for the event log (And as you have listed)

[WinEventLog:Microsoft-Windows-ApplicationExperience/Program-Inventory]
index = ...
...

View solution in original post

Highlighted

Re: Is there an easy way to access Microsoft specific folders for event log extraction?

Path Finder

Thanks! Just what I needed.

0 Karma