Filtering System Event log

Events
1

Hi Guys

I’m pretty new to relevance code, so I need some help. I managed to filter an event with the following code:

Q: descriptions of it of records whose (event id of it = 10001) of event log "Microsoft-Windows-NetworkProfile/Operational"

But i need an extra filter of that event. I only need the events that contains “Unnamed”.
I thought of this:

Q: descriptions of it of records whose (event id of it = 10001, descriptions of it contains "Unnamed") of event log "Microsoft-Windows-NetworkProfile/Operational"

But i get an error: A Singular expression is required.

I tried to change the second descriptions to description, but then I need a boolean.

Obviously i’m missing something (easy?), could you guys help me out?

Thank you!

1 Like
2

Looks like you were very close. Does this work for you?

descriptions of it of records whose (event id of it = 10001 and description of it as lowercase contains "unnamed") of event log "Microsoft-Windows-NetworkProfile/Operational"
2 Likes
3

Thanks man, works like a charm!

Just to be sure:
this works too?

(event id of it = 10001 and (description of it as lowercase contains "unnamed" or description of it as lowercase contains "x"))

Thanks for your help!