The path of the folder that will contain the text files that will contain the events. The name of the remote (or local) computer you'd like to search on. The latest date/time you'd like to begin searching for events. The earliest date/time you'd like to begin searching for events. Or contains a line with a date/time reference within the timeframe. With an extension inside the $FileExtension param that either was last written within the timeframe This example finds all event log entries between StartTimestamp and EndTimestamp and any file Maybe I know I’m looking for an event with an ID of 916 we’d pass 916 to the InstanceId parameter. We can also filter events based on other attributes like event ID (Instance ID) and message which tend to be common attributes to search on. The Get-EventLog has a lot of different ways to filter not including based on a timestamp. We could also perform the same process but select events that happened before a certain date with, you might have guessed it, the Before parameter. The After parameter takes a date/time, so if I’d like to find only the events within the Application log that happened after 1/26/19 10:17 AM, I could do this Get-EventLog -LogName Application -After '1/26/19 10:17'. Perhaps I want to find all events after a particular point in time.

Get-EventLog -LogName Application -Newest 10 will return only the latest ten events. In that case, I can use the Newest parameter and specify how many events I’d like to see.

To demonstrate filtering, perhaps I’m querying for events every so often, and I want to find the ten newest events. This takes care of the majority of ways to find events. The Get-EventLog cmdlet can filter based on timestamp, entry type, event ID, message, source, and username. Get-EventLog has a few different ways to do this. In that case, we need to filter for particular events.

Get-EventLog -LogName Application | Select-Object -Property * EventID Filtering with Get-EventLogĬhances are when looking for events, we don’t need all events.

System event log for more information