Get-WinEvent filterhashtable AND path?

This topic contains 2 replies, has 2 voices, and was last updated by Profile photo of Dave Wyatt Dave Wyatt 6 months, 3 weeks ago.

  • Author
    Posts
  • #39114
    Profile photo of Cody Everingham
    Cody Everingham
    Participant

    This works Get-WinEvent -FilterHashtable @{logname='Application'} This doesn't Get-WinEvent -path C:\somevent.evtx -FilterHashtable @{logname='Application'}. Does anyone know if you can specify a specific event log when filtering instead of the computers current one?

  • #39115
    Profile photo of Cody Everingham
    Cody Everingham
    Participant

    I have no clue how I missed this.
    Get-winevent -FilterHashtable @{Path="C:\somevent.evtx; logname='Application'}
    Anyways I simply needed to do the above to solve my issue.

  • #39117
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You would just use -FilterHashtable and add a Path key to it:

    Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Path = 'C:\someevent.evtx' }
    

    https://technet.microsoft.com/library/5fe94870-ed6b-4ce2-9500-93846cc65c95%28v=wps.630%29.aspx has all the details. 🙂

You must be logged in to reply to this topic.