Get-WinEvent filterhashtable AND path?

This topic contains 2 replies, has 2 voices, and was last updated by  Dave Wyatt 2 years, 2 months ago.

  • Author
  • #39114

    Cody Everingham

    This works Get-WinEvent -FilterHashtable @{logname='Application'} This doesn't Get-WinEvent -path C:\somevent.evtx -FilterHashtable @{logname='Application'}. Does anyone know if you can specify a specific event log when filtering instead of the computers current one?

  • #39115

    Cody Everingham

    I have no clue how I missed this.
    Get-winevent -FilterHashtable @{Path="C:\somevent.evtx; logname='Application'}
    Anyways I simply needed to do the above to solve my issue.

  • #39117

    Dave Wyatt

    You would just use -FilterHashtable and add a Path key to it:

    Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Path = 'C:\someevent.evtx' }
 has all the details. 🙂

You must be logged in to reply to this topic.