locked
Retrieve event log entries from remote PC? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I need to retrieve the top N "Application" event log entries for a given remote machine.  Specifically, I need the Time, Source, and Message (non-truncated) column outputs.  How best to do this?

    thanks

    Wednesday, April 30, 2014 4:34 PM

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi,

    You can use Get-EventLog for this:

    Get-EventLog -LogName Application -Newest 10 -ComputerName COMPUTERNAME | 
    Export-Csv .\events.csv -NoTypeInformation

    Get-EventLog is okay, but you may find that you need to start using Get-WinEvent if your needs ever change.

    EDIT:

    If all you want is the time, source and message, you can use this instead:

    Get-EventLog -LogName Application -Newest 10 -ComputerName COMPUTERNAME |
    Select TimeGenerated, Source, Message | 
        Export-Csv .\events.csv -NoTypeInformation

    You may want to use TimeWritten instead of TimeGenerated, that's up to you.

    Don't retire TechNet! - (Don't give up yet - 12,830+ strong and growing)

    Wednesday, April 30, 2014 5:06 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Scott_m,

    I’m writing to just check in to see if the suggestions were helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up.

    If you have any feedback on our support, please click here.

    Best Regards,

    Anna

    TechNet Community Support

    Monday, May 5, 2014 1:41 AM