Are you sure that 866 is the correct event id as returned by the inspector, not just what it says when you look at the event log in windows? I’ve seen cases where the ID returned by the inspector is longer or different than how it appears in the Event Log viewer. I have also seen cases where the same Event ID is shared by multiple events, further confusing the issue.
Check the event log ids with this:
unique values of event ids of records of application event log
Also try this:
descriptions of records whose (event id of it = 866 AND exists descriptions of it) of application event log
Also the event log inspector tends to be very slow, so it only works well in Analyses and should not be used in applicability relevance in most cases.
This query you provided “works” in the sense that it does not return errors - however the content returned is null. That has been my problem for some time.
Here’s an example in QnA for you;
q: descriptions of records whose (event id of it = 866 AND exists descriptions of it) of application event log
T: 1620.680 ms
Using psloglist, I’m able to retrieve the full event logs (for demonstration purposes, this is not ideal however). Notice how it says “Message text not available. Insertion strings”. I have a feeling this is why I’m not getting the descriptions of x event. Any ideas how to pull this string in BigFix?