I have a basic event trigger I wrote which works except in one case.... In Event viewer, I copied details to text and then copy and pasted the <EventData><Data> into the field below, but the task refuses to run in for this one event only. (The event details are actually a very long elaborate string - I shortened for this example) The text of the eventdata is the only way I have found to filter my task for the purpose I need. So to simplify things, I wanted to change "[EventData[Data[1]='Backup Test 2'" to only look for specific keywords and not match the entire <EventData><Data> field. For example, only match on the word "Test". Can anyone provide any advice on what operator to use to accomplish this? I've been searching Google for hours without success and I gather it's probably very simple... <QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[System[(Level=4 or Level=0) and (EventID=34112)]] and *[EventData[Data[1]='Backup Test 2']]</Select> </Query> </QueryList> Any help is appreciated. Thank you!