Group Events by a Given Property
Applies To: Windows Server 2008, Windows Vista
You can conveniently view all events that share the same value for a given event property. For example, you can view all the events that originated from the same source or all the Warning level events.
You can sort events by property, but the resulting groupings might be large and difficult to navigate. If you run into that limit with sorting, you can instead use the grouping feature of Event Viewer. When you group events, a descriptive heading appears in the list control above each group. Although all members of all groups are visible by default, you can collapse and expand each distinct group by double-clicking the corresponding group heading.
To group events according to a given property
Start Event Viewer.
In the console tree, navigate to and select an event log, custom view, or saved log.
In the header in the event list, right-click the column header that represents the property you want to group by and click Group events by this column.
Additional Considerations
To remove a grouping, right-click anywhere on the header of any column and click Remove grouping of events.
Event Viewer supports only one level of grouping. However, after grouping a set of events, you can then sort the resulting groups by column.
Grouping functionality works regardless of the source of the event records. As long as you are able to load a set of events, you can group them.