Possible to report on particular Event Viewer errors?
Basically I'd like to get a report/collection that shows computers that have failing hard disks. I can determine this on an individual machine by checking the Event Viewer and the Windows Logs - System area for an 'Level: Error' entry from 'Source: disk'.
I've made a Scan Profile in PDQ Inventory and set the trigger to scan age is 7 days old -
Scanner Name: EventViewer - disk
WQL Query: SELECT * FROM Win32_NTLogEvent WHERE Type != 'Information' AND SourceName LIKE 'disk'
Now how do I setup the report/collection? I think this is where I'm missing the obvious bit!
All - WMI (EventViewer - disk)
Column? Comparison? Value?
PS. Aware that there is already a Disk Drive - SMART status filter (which I am using) but that isn't conclusive enough.