Skip to content

Instantly share code, notes, and snippets.

@tostka

tostka/get-MultiLogTimelineToCsv.ps1

Last active April 23, 2018 15:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tostka/b809c2f759e5c84f39b02ac058378326 to your computer and use it in GitHub Desktop.
Save tostka/b809c2f759e5c84f39b02ac058378326 to your computer and use it in GitHub Desktop.
Download ZIP
1-liner script aimed at pulling all eventlog events over a specific time span, across multiple logs
Raw
get-MultiLogTimelineToCsv.ps1
$tlogs="System","Application","Lync Server" ;$tSrvr=$env:COMPUTERNAME ;$fltEvt=@{ logname=$null ; StartTime=(get-date "4/19/2018 1:00:00 PM") ; EndTime=(get-date "4/19/2018 3:40:00 PM") ; } ;$evts=$null ;$of=".\logs\ComboEvts-$($tlogs -join ',')-$($tSrvr)-SPAN-$(get-date $fltEvt.StartTime -format 'yyyyMMdd-HHmmtt')-TO-$(get-date $fltEvt.EndTime -format 'yyyyMMdd-HHmmtt').csv" ;foreach($tlog in $tlogs){ $fltEvt.logname=$tlog ; $lEvts = Get-WinEvent -computername $tSrvr -FilterHashtable $fltEvt | select TimeCreated,@{Name='Logname';Expression={$tlog}},Level,LevelDisplayName ,ProviderName,Id,Message ; $evts+=$lEvts ; "Log:$($fltEvt.logname):Evts:$(($lEvts|measure).count)/$(($evts|measure).count) Ttl" ;} ;$evts | sort TimeCreated | export-csv -path $of -notype ;$of=resolve-path $of ;"Evts exported to`n$($of)" ;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment