The "Source Name" within the "Sources and Event ids Properties", and/or "Sources" has an incorrect source named and thus the filter fails when querying Microsoft Windows events.
The "Source Name" must be defined as "Microsoft-Windows-Events" without the quotation marks as this is the Microsoft Windows name which can be correctly queried.
The "Source Name" is found within the "Sources and Event ids Properties", and/or "Sources", which are both found within the destination's "Event Filters".
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center