Custom Views are named filters that you can reuse between sessions of Event Viewer. Like other event log filters, a custom view has an XML-based representation. After creating a custom view using the Event Viewer user interface, you can then display and examine the XML that represents the underlying query. This is a convenient way to learn about the XML syntax.
To display the XML format underlying a custom view
-
Start Event Viewer.
-
In the console tree, navigate to and select the custom view.
-
On the Action menu, click Properties.
-
On the properties dialog, click Edit Filter.
-
In the Custom View Properties dialog box, click the XML tab. The XML query for the custom view appears in the text box.