CODEWITHSUNDEEP
c#.netpowershellevent-log
ViV
ViV

Reputation: 2118

Unique identifier for an event in Event Log

I have a Windows Event Log file (.evt/.evtx) and I want to select a particular event from the Event Log using power shell. I see cmdlets like

$provider = Get-WinEvent -listprovider $EventSource
$ProviderEvent = $provider.events | Where-Object {($_.ID -eq 4)}

to query the event log, but in my .evtx, there are multiple events with same ID.

Hence, my question is - how to pin point to an individual event, (using what fields)?

Upvotes: 0

Views: 1511

Answers (1)

Shay Levy
Shay Levy

Reputation: 126712

Check the RecordId property:

$provider.events | Where-Object {$_.ID -eq 4} | foreach {$_.RecordId}

Upvotes: 1

Related Questions