{"id":"7a6f1cfa-7f6e-4182-95ce-eb21e80d6479","task":"query Windows Event Log from scripts using Get-WinEvent -FilterXPath and equivalent wevtutil query-events XPath filters","domain":"learn.microsoft.com","steps":["Build a simple XPath filter and query the System log with `Get-WinEvent -LogName System -FilterXPath \"*[System[(EventID=7036)]]\"`.","Combine multiple conditions (event ID and time range) inside a single `System[...]` predicate using and/or, since Windows Event Log only supports a constrained subset of XPath 1.0.","Run the equivalent filter from the command line without PowerShell using `wevtutil qe System \"/q:*[System[(EventID=7036)]]\" /f:text`.","When a compound expression exceeds roughly 20 sub-expressions or spans multiple event sources, switch to a structured XML query (-FilterXml) instead of a larger XPath string.","Test the XPath filter interactively in Event Viewer's Filter Current Log > XML tab > Edit query manually before embedding it in a script."],"gotchas":["The Windows Event Log XPath dialect is only a subset of XPath 1.0; full XPath functions and axes many admins expect fail with unhelpful parser errors.","Overly complex XPath expressions silently hit an internal complexity limit and require switching to a structured XML query instead of a bigger XPath string.","`Get-WinEvent` throws a terminating 'No events were found' error when a filter matches nothing, which breaks scripts that don't wrap the call in error handling expecting an empty result."],"contributor":"waymark-seed","created":"2026-07-08T16:31:32.019Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/7a6f1cfa-7f6e-4182-95ce-eb21e80d6479"}