Fix ERROR_EVT_INVALID_QUERY (0X00003A99) Fast

You're trying to run a custom query in Event Viewer, and it throws ERROR_EVT_INVALID_QUERY (0X00003A99). Yeah, that's frustrating. You just want to see specific logs, and Windows decides to be cryptic.

First, the quick fix

Open Event Viewer again. Go to Windows Logs > Application (or whatever log you were querying). Right-click Create Custom View. In the XML tab, look at the query. The most common culprit is a missing or extra / in a path element, or an unclosed tag.

Here's a real example I see all the time: someone copies a query from a blog post and it has a double slash like <Query Id="0" Path="/Application/">. The correct path is just <Query Id="0" Path="Application">. Remove that trailing slash.

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[EventID=4625]]</Select>
  </Query>
</QueryList>

Save the custom view with a new name. Test it. If it works, delete the old broken one.

Why this fix works

What's actually happening here is Event Viewer's XML parser is strict about the query schema. The error 0X00003A99 means the query structure didn't match what the Event Log engine expects. The Path attribute must exactly match a log name — not a file path, not a URL. Trailing slashes, wrong casing (like application instead of Application), or spaces in the path all break it.

The reason step 3 works is the parser validates the entire XML before running the query. Any invalid character or structure causes this exact error. By simplifying the path and removing noise, you give it a clean input it can actually parse.

Less common variations of the same issue

1. Query references a log that doesn't exist

Maybe you renamed a log, or the log was created by a service that's no longer running. Check if Path="MyCustomLog" actually shows up in Event Viewer's left panel. If not, change the path to Application or System and adjust the select filter.

2. Invalid XPath expression

The <Select> element uses XPath 1.0 syntax. A common mistake is using @Name when you meant @name (lowercase). XML attributes are case-sensitive. Also, *[System[EventID=4625]] is valid, but *[System[EventID='4625']] with quotes is not — Event Viewer doesn't allow single quotes in this context. Use numbers directly.

3. Multiple queries with conflicting paths

If you have multiple <Query> elements inside <QueryList>, each must have a unique Id attribute (0, 1, 2…). Also, if two queries use different Path values, the second one overrides the first. That can cause confusion. Stick to one query per view unless you really need multiple.

4. Corrupted custom view XML

Sometimes the XML file itself gets corrupted. Close Event Viewer. Go to %USERPROFILE%\AppData\Local\Microsoft\Event Viewer\. Look for files named CustomViews.xml or similar. Delete the file that contains the broken view. Restart Event Viewer — it regenerates the default views. You'll lose all custom views, but it's a nuclear option that works.

Prevention tips

• Always test a new query on a small log first. Use Application log with a filter like *[System[EventID=1]] to verify the syntax works before building complex queries.
• Back up your custom views. Export them by right-clicking the view and selecting Export Custom View. Save the .xml file somewhere safe. If you break it, reimport.
• Never copy queries from forums without checking the path. People often include / or extra quotes. Manually review the XML before importing.
• Use PowerShell instead for complex queries. Get-WinEvent -FilterXPath '...' gives clearer error messages when something's wrong. For example, Get-WinEvent -LogName Application -FilterXPath '*[System[EventID=4625]]'. If that fails, the error message tells you exactly where the XPath breaks.

That's it. Next time you see 0X00003A99, check the path first, then the XPath. Nine times out of ten, it's a trailing slash or a typo in the event ID.