diff --git a/Sources/EventViewerX/SearchEvents.QueryLog.cs b/Sources/EventViewerX/SearchEvents.QueryLog.cs index e9ee6e3..aedc116 100644 --- a/Sources/EventViewerX/SearchEvents.QueryLog.cs +++ b/Sources/EventViewerX/SearchEvents.QueryLog.cs @@ -298,7 +298,7 @@ private static string BuildQueryString(string logName, List eventIds = null // Add keywords to the query if (keywords.HasValue) { - AddCondition(queryString, $"Keywords={(long)keywords.Value}"); + AddCondition(queryString, $"band(Keywords,{(long)keywords.Value})"); } // Add level to the query diff --git a/Tests/Get-EVXFilter.Tests.ps1 b/Tests/Get-EVXFilter.Tests.ps1 index 4430fe5..39c88bb 100644 --- a/Tests/Get-EVXFilter.Tests.ps1 +++ b/Tests/Get-EVXFilter.Tests.ps1 @@ -39,4 +39,14 @@ Describe 'Additional Get-WinEventFilter cases' { $XPath = Get-EVXFilter -ExcludeID 1,2 -LogName 'xx' -XPathOnly $XPath | Should -Be '*[System[(EventID!=1) or (EventID!=2)]]' } + + It '-Keywords single value should produce band filter' { + $XPath = Get-EVXFilter -Keywords 1125899906842624 -LogName 'xx' -XPathOnly + $XPath | Should -Be '*[System[band(Keywords,1125899906842624)]]' + } + + It '-Keywords multiple values should OR them in band filter' { + $XPath = Get-EVXFilter -Keywords 1125899906842624,281474976710656 -LogName 'xx' -XPathOnly + $XPath | Should -Be '*[System[band(Keywords,1407374883553280)]]' + } } diff --git a/Tests/Get-EVXFilter1.Tests.ps1 b/Tests/Get-EVXFilter1.Tests.ps1 index 6213846..68e8ac6 100644 --- a/Tests/Get-EVXFilter1.Tests.ps1 +++ b/Tests/Get-EVXFilter1.Tests.ps1 @@ -29,4 +29,14 @@ Describe "Get-EventFilters using Path and NamendDataFilter" { $XML | Should -BeLike '*Query Id="0" Path="file://*' -Because 'We wanted to query a filepath' $XML | Should -Not -Belike '*Select Path*' -Because 'Queries using eventfiles do not have a Channel' } + + It '-Keywords single value should produce band filter' { + $XPath = Get-EVXFilter -Keywords 1125899906842624 -LogName 'xx' -XPathOnly + $XPath | Should -Be '*[System[band(Keywords,1125899906842624)]]' + } + + It '-Keywords multiple values should OR them in band filter' { + $XPath = Get-EVXFilter -Keywords 1125899906842624,281474976710656 -LogName 'xx' -XPathOnly + $XPath | Should -Be '*[System[band(Keywords,1407374883553280)]]' + } } \ No newline at end of file