Thanks,
I had same issue today. Thinking to create template on one server and use same on all other machines, but thought to test, if this really works:
Error:
Subscription failed with error 15001, the specified query is invalid.
1. Created a standard subscription (security events)
2. Stopped solarwinds windows event forwarder service
3. Moved the .cfg file in a new folder
4. Started the solarwinds windows event forwarder service, this created a new file.
5. Stopped the service again
6. Now replaced newly created file with the one created in step 1 (with subscription)
7. started service, it started throwing error
8. Replaced following and it started working with hexadecimal values
Original values:
<string>Audit Success</string>
<string>Audit Failure</string>
new values:
<string>0x20000000000000</string>
<string>0x10000000000000</string>
Seems some bug in version 1.2.0 @Slorwinds, any proper solution of this issue?
