I did research and found around 10 different threads asking similar questions. I also found different ways to do it: linq, xpath, etc.

I tried all of them but I never get any result. It is always 'null'.

So here is my xml; I want the **OpCorrelation as a string**:

```
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="Microsoft-Windows" Guid="{123}" /> 
  <EventID>12</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>1</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x1110000000000000</Keywords> 
  <TimeCreated SystemTime="2017-07-26T11:08:06.899918600Z" /> 
  <EventRecordID>3333</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="2" ThreadID="3" /> 
  <Channel>Security</Channel> 
  <Computer>test</Computer> 
  <Security /> 
</System>
<EventData>
  <Data Name="OpCorrelationID">{abc}</Data> 
  <Data Name="AppCorrelationID">-</Data> 
  <Data Name="SubjectUserSid">123-S-123</Data> 
  <Data Name="SubjectUserName">TestUser</Data> 
  <Data Name="SubjectDomainName">TEST</Data> 
  <Data Name="SubjectLogonId">0x3a111</Data> 
  <Data Name="DSName">test.local</Data> 
  <Data Name="DSType">%%14111</Data> 
  <Data Name="ObjectDN">cn=bbbbb bb. bbb,OU=test,OU=Test123,DC=test,DC=local</Data> 
  <Data Name="ObjectGUID">{DF0F5628-70DA-4AC4-B72E-111111111}</Data> 
  <Data Name="ObjectClass">user</Data> 
  <Data Name="AttributeLDAPDisplayName">pwdLastSet</Data> 
  <Data Name="AttributeSyntaxOID">2.5.5.16</Data> 
  <Data Name="AttributeValue">131455408816821756</Data> 
  <Data Name="OperationType">%%14675</Data> 
</EventData>

```

And here is the code I tried:

```
string OpCorrelationID = (string)XDocument.Parse(record.ToXml()).Descendants("Data").FirstOrDefault(d => (string)d.Attribute("Name") == "OpCorrelationID");

```

and

```
string OpCorrelationID = XDocument.Parse(record.ToXml()).XPathSelectElement("descendant::Data[@Name='OpCorrelationID']").Value;

```