<QueryList> <Query Id="0" Path="Application"> <Select Path="Application"> *[System[(Level=0) and TimeCreated[@SystemTime > '2015-04-14T00:00:00.000000000Z']]] </Select> </Query> </QueryList>This only returns two events and I have about a hundred when I use the Event Viewer regular interface.