CODEWITHSUNDEEP
powershellfilterevent-log
Thomas Lang
Thomas Lang

Reputation: 231

search in saved eventlog-file with powershell

I have got some saved eventlogfiles (*.evtx). I want to search the ml-data for a specific textstring.

I found this solution for the current system eventlog:

Get-EventLog -LogName APPLICATION -After 04/01/2018 | Where-Object { $_.Message -like '*AVAST*' }

Is it possible to search a saved eventlog file with this string?

Upvotes: 1

Views: 4497

Answers (1)

Nas
Nas

Reputation: 1263

Use the Get-WinEvent cmdlet,

Get-WinEvent -Path C:\file.evtx | Where-Object { $_.Message -like '*AVAST*' }

Upvotes: 1

Related Questions