Display XML Format of a Custom View
Applies To: Windows 7, Windows Server 2008 R2, Windows Server 2012, Windows Vista
Custom Views are named filters that you can reuse between sessions of Event Viewer. Like other event log filters, a custom view has an XML-based representation. After creating a custom view using the Event Viewer user interface, you can then display and examine the XML that represents the underlying query. This is a convenient way to learn about the XML syntax.
To display the XML format underlying a custom view
Start Event Viewer.
In the console tree, navigate to and select the custom view.
On the Action menu, click Properties .
On the properties dialog, click Edit Filter .
In the Custom View Properties dialog box, click the XML tab. The XML query for the custom view appears in the text box.