Powershell – Script to export custom view Event Viewer to .evtx Powershell

eventviewerpowershellwindows-server-2008

This is my PowerShell script to export data from a Custom View in the Event Viewer via the XML data.

set-executionpolicy unrestricted

[xml]$CustomView = @"
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
    <Select Path="Security">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
    <Select Path="Setup">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
    <Select Path="System">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
    <Select Path="ForwardedEvents">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>

Alot of rules etc... I excluded a couple because it was 300000 characters limited.

  </Query>
</QueryList>
"@

Get-WinEvent -FilterXML $CustomView | Export-CSV "C:\LogFiles\ServiceTool_Log_$(Get-Date -format "yyyy-MM-dd").log"

How can I export my log as an .evtx or a .csv to make it human readable?

Best Answer

You are already using the Export-CSV cmmdlet in the right way, you simply need to change your extension to a .txt. PowerShell will export it for you in a human readable format. It should look like this:

Export-CSV "C:\LogFiles\ServiceTool_Log_$(Get-Date -format "yyyy-MM-dd").txt"

I'm not sure about the .evtx side of things, but doing the Export-CSV to a .txt will always produce a line by line replica of the data you're extracting.

I have referenced this before when trying to get custom data to a CSV/Excel Spreadsheet before too.

This reference provides a way to export a whole log using the wevutil command. You will have to check if it works on your custom view or not.

Related Topic