Custom Views are named filters that you can reuse between sessions of Event Viewer. Like other event log filters, a custom view has an XML-based representation. After creating a custom view using the Event Viewer user interface, you can then display and examine the XML that represents the underlying query. This is a convenient way to learn about the XML syntax.
 | To display the XML format underlying a custom view |
Start Event Viewer.
In the console tree, navigate to and select the custom view.
On the Action menu, click Properties.
On the properties dialog, click Edit Filter.
In the Custom View Properties dialog box, click the XML tab. The XML query for the custom view appears in the text box.