---
title: How To Filter The Windows Event Log By IP Address (How to)
description: How To Filter The Windows Event Log By IP Address
---

[Skip to content](https://help.bestofbreed.eu/how-to-filter-the-windows-event-log-by-ip-address-how-to#main-content)

English

Show submenu for translations

[Create a ticket](https://help.bestofbreed.eu/kb-tickets/new?hsLang=en)

![BestofBreed\_logo.svg\]](https://help.bestofbreed.eu/hubfs/BestofBreed_logo.svg)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Create a ticket](https://help.bestofbreed.eu/kb-tickets/new)
- [Home](http://bestofbreed.no/)

[Home](http://bestofbreed.no/)

 How can we help you?

- There are no suggestions because the search field is empty.

1. [Help Center](https://help.bestofbreed.eu/?hsLang=en)
2. [PaperCut MF](https://help.bestofbreed.eu/papercut-mf?hsLang=en)
3. [How to](https://help.bestofbreed.eu/papercut-mf?hsLang=en#how-to)

# How To Filter The Windows Event Log By IP Address (How to)

## How To Filter The Windows Event Log By IP Address

Sounds simple until you try.

There does not appear to be a way to filter the [Windows Event Log](https://www.papercut.com/kb/Main/LogPrintJobsInEventViewer) by IP address using the **Filter** tab (the GUI options). Rather, you must use the **XML** tab and write your own query.

On the **XML** tab, first enable the option **Edit query manually**. The initial query will look something like this:

 

```
<QueryList>  <Query Id="0" Path="file://C:\path\to\file.evtx">    <Select Path="file://C:\path\to\file.evtx">*</Select>  </Query></QueryList>
```

You will need to edit the content of the Select element. Replace the asterisk so that the query looks like the following:

 

```
<QueryList>  <Query Id="0" Path="file://C:\path\to\file.evtx">    <Select Path="file://C:\path\to\file.evtx">      *[EventData[Data[@Name='IpAddress'] and(Data='127.0.0.1')]]    </Select>  </Query></QueryList>
```

Where 127.0.0.1 is the IP address to filter on. Hit OK and you’re done!

If you know the name of another property to filter on, you can use the following generic syntax:

```
*[EventData[Data[@Name='PropertyName'] and(Data='PropertyValue')]]
```

 

[Link to original article](https://www.papercut.com/kb/Main/HowToFilterTheWindowsEventLogByIPAddress)

 

- [AI](https://help.bestofbreed.eu/ai?hsLang=en)
- [RPA](https://help.bestofbreed.eu/rpa?hsLang=en#main-content)

    - [Software Testing](https://help.bestofbreed.eu/rpa?hsLang=en#software-testing)
- [Professional Services](https://help.bestofbreed.eu/professional-services?hsLang=en)
- [Printix](https://help.bestofbreed.eu/printix?hsLang=en#main-content)

    - [Security](https://help.bestofbreed.eu/printix?hsLang=en#security)
- [PaperCut MF](https://help.bestofbreed.eu/papercut-mf?hsLang=en#main-content)

    - [FAQs](https://help.bestofbreed.eu/papercut-mf?hsLang=en#faqs)
    - [How to](https://help.bestofbreed.eu/papercut-mf?hsLang=en#how-to)
    - [Troubleshooting](https://help.bestofbreed.eu/papercut-mf?hsLang=en#troubleshooting)
    - [Known Issues](https://help.bestofbreed.eu/papercut-mf?hsLang=en#known-issues)
- [Tungsten SafeCom](https://help.bestofbreed.eu/tungsten-safecom?hsLang=en#main-content)

    - [How to](https://help.bestofbreed.eu/tungsten-safecom?hsLang=en#how-to)
    - [FAQs](https://help.bestofbreed.eu/tungsten-safecom?hsLang=en#faqs)
    - [Known Issues](https://help.bestofbreed.eu/tungsten-safecom?hsLang=en#known-issues)
    - [Troubleshooting](https://help.bestofbreed.eu/tungsten-safecom?hsLang=en#troubleshooting)
- [Tungsten ControlSuite](https://help.bestofbreed.eu/tungsten-controlsuite?hsLang=en)
- [Tungsten AutoStore](https://help.bestofbreed.eu/tungsten-autostore?hsLang=en)
- [Tungsten Equitrac](https://help.bestofbreed.eu/tungsten-equitrac?hsLang=en)

[![Chill listening crop-3](https://help.bestofbreed.eu/hubfs/BestofBreed_logo.svg "Chill listening crop-3")](https://www.bestofbreed.no?hsLang=en)

Service isn't something you get - You experience it!

<https://www.linkedin.com/company/best-of-breed-as/?viewAsMember=true> <https://www.facebook.com/bestofbreed/> <https://twitter.com/bestofbreedas>

Copyright © 2026, Best of Breed