Get-WinEvent filterhashtable AND path?

This topic contains 2 replies, has 2 voices, and was last updated by Profile photo of Dave Wyatt Dave Wyatt 4 months, 2 weeks ago.

Viewing 3 posts - 1 through 3 (of 3 total)
  • Author
    Posts
  • #39114
    Profile photo of Cody Everingham
    Cody Everingham
    Participant

    This works Get-WinEvent -FilterHashtable @{logname='Application'} This doesn't Get-WinEvent -path C:\somevent.evtx -FilterHashtable @{logname='Application'}. Does anyone know if you can specify a specific event log when filtering instead of the computers current one?

    #39115
    Profile photo of Cody Everingham
    Cody Everingham
    Participant

    I have no clue how I missed this.
    Get-winevent -FilterHashtable @{Path="C:\somevent.evtx; logname='Application'}
    Anyways I simply needed to do the above to solve my issue.

    #39117
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You would just use -FilterHashtable and add a Path key to it:

    Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Path = 'C:\someevent.evtx' }
    

    https://technet.microsoft.com/library/5fe94870-ed6b-4ce2-9500-93846cc65c95%28v=wps.630%29.aspx has all the details. 🙂

Viewing 3 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.