Forum Discussion

cxmelga's avatar
cxmelga
Copper Contributor
Feb 17, 2022

A simple Custom XPath Data Source Collection is not working

Can someone please help me with the following   I read the following document https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent   I am following...
azure monitor
cxmelga's avatar
cxmelga
Copper Contributor
Feb 18, 2022

cxmelga 

 

I have this working now so case closed as it were 🙂

Swdowsett's avatar
Swdowsett
Copper Contributor
Apr 20, 2022

cxmelga What did you do to resolve this? I am trying to collect other events from a custom channel but having no luck

  • cxmelga's avatar
    cxmelga
    Copper Contributor
    May 07, 2022
    Yes I fixed it I will try and show you an example later (as I need to dig it out)
    Thanks
    • Ron Howe's avatar
      Ron Howe
      Copper Contributor
      Jun 29, 2022
      Could you post your fix? I'm having the same issue.
      • Swdowsett's avatar
        Swdowsett
        Copper Contributor
        Jun 29, 2022

        Ron Howe I ended up getting this working. This only seems to work on Windows Security Events via AMA connector not the Windows Forwarded Events (Preview) connector.

         

        When specifying the XPATH for a custom location:

        CustomLog/CustomChannel!*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]] and so on. Seems the supported method is to use the short hand.

Resources