Grouping eventcode

[Michael_Schyma1]

Is there a way to group several eventcodes so I dont have to keep on repeating myself. I can not seem to get the right syntax. So instead of "

EventCode=644" OR "EventCode=4740" OR "EventCode=671"

Is there a way to just say

Eventcode="644,4740,671" Or something like that?

[MHibbin · Accepted solution]

You could create an eventype for certain groupings of "EventCode" (if they are fairly static) check here.