Reputation: 395
I need to get a list of events that have id of 6005 or 6006 using "wevtutil" tool. This command works fine:
wevtutil qe system /rd:true /q:*[System[EventID=6005]]
But I need to get both events with ID 6005 and 6006. I tried
wevtutil qe system /rd:true /q:*[System[EventID=6005 or EventID=6006]]
But it returns
Too many arguments are specified. The parameter is incorrect.
How should I fix it?
Note: each event has the following XML structure
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='EventLog'/><EventID Qualifiers='32768'>6005</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2018-01-24T18:24:41.592259500Z'/><EventRecordID>350</EventRecordID><Channel>System</Channel><Computer>LAPTOP-IN03NS68</Computer><Security/></System><EventData><Binary>E20701000300180012001800290050020000000000000000</Binary></EventData></Event>
Upvotes: 0
Views: 3570