none
How to get full event log message using powershell RRS feed

  • Question

  • Get-EventLog  -LogName "System"  -After (((Get-Date).addDays(-2)).date) -Before  (Get-Date)  | Where-Object {($_.Message -like "*shutdown*")   -or ($_.EventID -like "1074") }| Select-OMachineName,TimeGeneratedbject , message

    Hi team..i am trying to pull the eventlogs  using above commands. I am able to pull the logs based on my requirement.

    how ever I am not seeing full message..

    I want full message of event logs. can some one please help on this..

     

     

    Sunday, December 17, 2017 5:58 AM

Answers

  • It is a very bad idea to place all elements of a command on one line.  A pipelime shuld be broken into multiple lines based on the pipe.

    There is no command like "Select-Omachine".  Have you made a typo.

    To select events by ID we would not use Get-Eventlog.  "Get-Eventlg" is an obsolete command.

    Get-WinEvent -FilterHashTable @{Logname='System';ID=1074} | 
         Format-Table TimeCreated,Message -wrap

    Matching "Shutdown" in the message is pointless as event ID 1074 is always a "Shutdown" event.


    \_(ツ)_/

    Sunday, December 17, 2017 6:54 AM

All replies

  • It is a very bad idea to place all elements of a command on one line.  A pipelime shuld be broken into multiple lines based on the pipe.

    There is no command like "Select-Omachine".  Have you made a typo.

    To select events by ID we would not use Get-Eventlog.  "Get-Eventlg" is an obsolete command.

    Get-WinEvent -FilterHashTable @{Logname='System';ID=1074} | 
         Format-Table TimeCreated,Message -wrap

    Matching "Shutdown" in the message is pointless as event ID 1074 is always a "Shutdown" event.


    \_(ツ)_/

    Sunday, December 17, 2017 6:54 AM
  • Yes it's a typo.. Thanks Master ..can I use date ranges for querying event logs
    Sunday, December 17, 2017 7:13 AM
  • help Get-WinEvent -online

    \_(ツ)_/

    Sunday, December 17, 2017 7:17 AM
  • Thanks master
    Sunday, December 17, 2017 7:22 AM