Using XPath starts-with or contains functions to search Windows event logs

Windows Event Log supports a subset of XPath 1.0. It has only three functions: position, Band, timediff.

Reference: https://docs.microsoft.com/en-us/windows/desktop/WES/consuming-events#xpath-10-limitations

If you don't mind two passes, you can always use a powershell script to re-filter the data as its          -where operator supports -like, -match, and -contains:

nv.ps1

$Query = @"  <QueryList>    <Query Id="0" Path="System">      <Select Path="System">        *[System[(EventID=20001)]]      </Select>    </Query>  </QueryList>"@$events = Get-WinEvent -FilterXml $QueryForEach ($Event in $Events) {    # Convert the event to XML    $eventXML = [xml]$Event.ToXml()    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  Data -Value $eventXML.Event.EventData.Data}$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridViewpause

A cmd to launch it (nv.cmd):

powershell.exe -executionpolicy bypass "& '.\nv.ps1'"

A quick powershell to search for session* in data. Even if data were an array, this should work.

get-winevent application | where { $xml = [xml]$_.toxml()   $xml.event.eventdata.data -like 'session*' } | select -first 3   ProviderName: Microsoft-Windows-WinlogonTimeCreated                     Id LevelDisplayName Message-----------                     -- ---------------- -------2/22/2020 11:05:30 AM         6000 Information      The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.2/22/2020 11:05:30 AM         6003 Information      The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.2/21/2020 6:28:38 PM          6000 Information      The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.$xml.event.eventdata.data # the last oneSessionEnv

If you don't need the precision, it's easier to match on the message, which the data fields often appear in.

get-winevent application | where message -match session