I've been trying to find a way to filter the Event Viewer in Windows by the description instead of the event type/source etc. I figure that i need to use the XML tab to customise it as there is no option in the basic filtering for what I want.
One reason why I want to do this is to find when I service was started. The sytem logs show when services stop and start but they all have the same event ID, Event Type and Source.
The "description" I'm referring to is the text you see in the "General" tab. It would read something like:
The [service name] service entered the stopped state.
I'm looking to just search the event viewer for the service name. I've looked online for tips on how to do this using the CML tab in the filter but I can only find information on how to filter it by the basic options using the XML tab which seems pointless when I can just tick the box in the filter tab anyway.