Aleks: /* Search Through Event Logs With Powershell */

2025-02-03T15:09:35Z

Search Through Event Logs With Powershell

← Older revision		Revision as of 16:09, 3 February 2025
Line 17:		Line 17:
	#Find Specific Text in message		#Find Specific Text in message
	Get-WinEvent -FilterHashtable @{logname='System'}\|Where {$_.Message -like "USB"}		Get-WinEvent -FilterHashtable @{logname='System'}\|Where {$_.Message -like "USB"}

			#Get Events from Remote computers
			$servers = @("server1","Server2")
			$servers \| foreach-object {Get-WinEvent -ComputerName $_ -FilterHashtable @{logname="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"} \| Where-Object {$_.Message -like "<username>"}}
	</syntaxhighlight>		</syntaxhighlight>

Aleks: Created page with "== Search Through Event Logs With Powershell == Search through event logs using Get-WinEvent: [https://woshub.com/search-windows-event-logs-powershell/ Reference] #Get full list of event log names to use in filters: Get-WinEvent -ListLog * #Get events from multiple logs in a time period (last day) $StartDate = (Get-Date) - (New-TimeSpan -Day 1) Get-WinEvent Application,System | Where-Object {($_.LevelDisplayName -eq "Error" -or $_.Lev..."

2025-02-03T15:06:12Z

Created page with "== Search Through Event Logs With Powershell == Search through event logs using Get-WinEvent: [https://woshub.com/search-windows-event-logs-powershell/ Reference]<syntaxhighlight lang="powershell"> #Get full list of event log names to use in filters: Get-WinEvent -ListLog * #Get events from multiple logs in a time period (last day) $StartDate = (Get-Date) - (New-TimeSpan -Day 1) Get-WinEvent Application,System | Where-Object {($_.LevelDisplayName -eq "Error" -or $_.Lev..."

New page

== Search Through Event Logs With Powershell ==
Search through event logs using Get-WinEvent: [https://woshub.com/search-windows-event-logs-powershell/ Reference]<syntaxhighlight lang="powershell">

#Get full list of event log names to use in filters:
Get-WinEvent -ListLog *

#Get events from multiple logs in a time period (last day)
$StartDate = (Get-Date) - (New-TimeSpan -Day 1)
Get-WinEvent Application,System | Where-Object {($_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Warning") -and ($_.TimeCreated -ge $StartDate )}

#Search for events in a specific time period
Get-winevent -filterhashtable @{logname="Microsoft-Windows-TerminalServices-SessionBroker/Operational"; starttime="12:20pm"; EndTime="12:25pm"} | Where-Object {$_.Message -like "*<username>*"}

#Find Events by ID
Get-WinEvent -FilterHashtable @{logname='System';id=1074}|ft TimeCreated,Id,Message

#Find Specific Text in message
Get-WinEvent -FilterHashtable @{logname='System'}|Where {$_.Message -like "*USB*"}
</syntaxhighlight>

Eventviewer - Revision history

Aleks: /* Search Through Event Logs With Powershell */