Why is the "Task category" drop down to filter a Windows event log disabled?

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?

Solution 1:

The "Task category" is only available to filter a log once you've already selected something for "Event sources" above that in the "Filter Current Log" dialog. Note that in every case I've checked, you can only have one "Event sources" selected, or "Task category" gets disabled again.

That said, for the category you want filter for, first figure out what the source is, select it, and then select the task category.

After some hunting, I had finally found the answer to this here and thought I'd share: https://social.technet.microsoft.com/forums/windowsserver/en-US/c5bafdd9-2e70-4ba5-ab0b-018e86adbc97/filtering-2008-r2-event-log-security

Solution 2:

I´m adding this answer because I also couldn't filter. So you need to manually edit the xml. Enter in Edit your Custom View Properties. than go to the tab XML and hit the checkbox "Edit query manually"

you will have something like these:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='quem ME atende'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]</Select>
  </Query>
</QueryList>

So you need to add another Filter (Level is already added, Warning, Error etc) So add "and (Task=12)" Where 12 is number of your category!

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='quem ME atende'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5) and (Task=12)]]</Select>
  </Query>
</QueryList>

And here you go, you may have to refresh the View more than once, as it is tricky!