Skip to content

Commit e2aece4

Browse files
Merge pull request #270674 from JeffreyWolford/patch-21
Update data-collection-rule-azure-monitor-agent.md
2 parents 2330c0c + 933b2ba commit e2aece4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/azure-monitor/agents/data-collection-rule-azure-monitor-agent.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ When you paste the XPath query into the field on the **Add data source** screen,
351351

352352

353353
> [!TIP]
354-
> You can use the PowerShell cmdlet `Get-WinEvent` with the `FilterXPath` parameter to test the validity of an XPath query locally on your machine first. For more information, see the tip provided in the [Windows agent-based connections](../../sentinel/connect-services-windows-based.md) instructions. The [`Get-WinEvent`](/powershell/module/microsoft.powershell.diagnostics/get-winevent) PowerShell cmdlet supports up to 23 expressions. Azure Monitor data collection rules support up to 20. Also, `>` and `<` characters must be encoded as `&gt;` and `&lt;` in your data collection rule. The following script shows an example:
354+
> You can use the PowerShell cmdlet `Get-WinEvent` with the `FilterXPath` parameter to test the validity of an XPath query locally on your machine first. For more information, see the tip provided in the [Windows agent-based connections](../../sentinel/connect-services-windows-based.md) instructions. The [`Get-WinEvent`](/powershell/module/microsoft.powershell.diagnostics/get-winevent) PowerShell cmdlet supports up to 23 expressions. Azure Monitor data collection rules support up to 20. The following script shows an example:
355355
>
356356
> ```powershell
357357
> $XPath = '*[System[EventID=1035]]'

0 commit comments

Comments
 (0)