CODEWITHSUNDEEP
csvlogparser
yasin mohammed
yasin mohammed

Reputation: 471

Converting evtx log to csv error

I am trying to convert and evtx log file to csv from log parser 2.2. I just want to copy all of the data into a csv. 

LogParser "Select * INTO C:\Users\IBM_ADMI
N\Desktop\sample.csv FROM C:\Users\IBM_ADMIN\Desktop\Event    
Logs\sample.evtx" -i:EVTX -o:csv

But I am getting the error below.

Error: Syntax Error: extra token(s) after query: 'Logs\sample.evtx'

Please assist in solving this error.

Upvotes: 0

Views: 4009

Answers (3)

Sirojiddin Ziyadillayev
Sirojiddin Ziyadillayev

Reputation: 1

you have to convert .evtx file to .csv than you can read from this .csv file. like this .enter image description here

    //String command = "powershell.exe  your command";

            //called the PowerShell from java code

String command = "powershell.exe Get-WinEvent -Path C:\windows\System32\winevt\Logs\System.evtx | Export-Csv system.csv"; File seys = new File("system.csv"); Process powerShellProcess = Runtime.getRuntime().exec(command);

Upvotes: 0

addicted
addicted

Reputation: 3041

I know this has been a year but if you (or other people) still need it and for sake of reference, this is what I do:

LogParser "Select * INTO C:\Users\IBM_ADMIN\Desktop\sample.csv FROM 'C:\Users\IBM_ADMIN\Desktop\Event Logs\sample.evtx'" -i:evt -o:csv
  1. Correct input type is evt, not evtx.
  2. If there is space in the Event Logs folder, enclose with single quote.

Upvotes: 1

yasin mohammed
yasin mohammed

Reputation: 471

The Problem was due to the extra space in between the folder name Event Logs. Changed the folder name to a single workd and it worked.

Upvotes: 0

Related Questions