I don't know of a definitive source for the Wake Source codes, but next time you see a 0, try running the following command at a prompt:
powercfg -lastwake
it should hopefully give you more information than just a 0.
It's probably not going to be accurate for all event types, but the property ReplacementStrings is an array where the first element is the name of the executable when looking at InstanceID 1000:
> Get-EventLog application 1000 -entrytype error -newest 10 | %{$_.ReplacementStrings[0]}
Ssms.exe
Ssms.exe
Ssms.exe
uniStudio.exe
SwyxIt!.exe
Ssms.exe
uniRTE.exe
uniStudio.exe
Ssms.exe
Ssms.exe
My PS-foo is weak at this time of the morning, but I'm sure there's a way to combine that with your select command and thus export them into your CSV.
As per your update; this will get you the output you need in a table format. I don't know how well it will play with export-csv though:
Get-EventLog application 1000 -entrytype error -newest 10|Format-Table @{Expression={$_.machinename};Label="Machine Name";width=25},@{Expression={$_.timegenerated.DateTime};Label="DateTime";width=25},@{Expression={$_.ReplacementStrings[0]};Label="EXEName";width=25}
Never mind; I went way too complicated in my last update. This should work just fine (I knew I'd be better later in the day):
> Get-EventLog application 1000 -entrytype error -newest 10|Select-Object timegenerated,message,@{name='Executable';expression={$_.ReplacementStrings[0]}}|Export-CSV errors.csv
TimeGenerated Message Executable
------------- ------- ----------
14/01/2014 7:23:13 AM Faulting application name: Ssms.exe,... Ssms.exe
13/01/2014 7:26:44 AM Faulting application name: Ssms.exe,... Ssms.exe
10/01/2014 7:30:24 AM Faulting application name: Ssms.exe,... Ssms.exe
8/01/2014 5:25:13 PM The description for Event ID '1000' ... uniStudio.exe
31/12/2013 3:09:58 PM The description for Event ID '1000' ... SwyxIt!.exe
19/12/2013 7:35:21 AM Faulting application name: Ssms.exe,... Ssms.exe
18/12/2013 2:55:45 PM Faulting application name: uniRTE.ex... uniRTE.exe
18/12/2013 9:25:49 AM The description for Event ID '1000' ... uniStudio.exe
18/12/2013 7:32:29 AM Faulting application name: Ssms.exe,... Ssms.exe
16/12/2013 1:22:38 PM Faulting application name: Ssms.exe,... Ssms.exe
Best Answer
I resolved this by amending the manifest file reported in the error (
C:\Program Files\Microsoft Office 15\root\office15\LYNC.EXE.MANIFEST), changing the processor architecture of the UccApi DLL.Before:
<assemblyIdentity type="win32" name="UccApi" version="15.0.0.0" processorArchitecture="*"></assemblyIdentity>After:
<assemblyIdentity type="win32" name="UccApi" version="15.0.0.0" processorArchitecture="x86"></assemblyIdentity>