Retrieve event log entries from remote PC? RRS feed

  • Question

  • I need to retrieve the top N "Application" event log entries for a given remote machine.  Specifically, I need the Time, Source, and Message (non-truncated) column outputs.  How best to do this?


    Wednesday, April 30, 2014 4:34 PM

All replies

  • Hi,

    You can use Get-EventLog for this:

    Get-EventLog -LogName Application -Newest 10 -ComputerName COMPUTERNAME | 
        Export-Csv .\events.csv -NoTypeInformation

    Get-EventLog is okay, but you may find that you need to start using Get-WinEvent if your needs ever change.


    If all you want is the time, source and message, you can use this instead:

    Get-EventLog -LogName Application -Newest 10 -ComputerName COMPUTERNAME |
        Select TimeGenerated, Source, Message | 
            Export-Csv .\events.csv -NoTypeInformation

    You may want to use TimeWritten instead of TimeGenerated, that's up to you.

    Don't retire TechNet! - (Don't give up yet - 12,830+ strong and growing)

    Wednesday, April 30, 2014 5:06 PM
  • Hi Scott_m,

    I’m writing to just check in to see if the suggestions were helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up.

    If you have any feedback on our support, please click here.

    Best Regards,


    TechNet Community Support

    Monday, May 5, 2014 1:41 AM