2

Using powershell, is there any way we can export system event logs from a saved system event log file (*.evt). Get-Eventlog does not recognize the "-logname "Saved system log"".

Any ideas ?

whizkid
  • 355
  • 1
  • 4
  • 16

1 Answers1

2

Use the Path parameter. 

Get-WinEvent -Path filename.evt
pk.
  • 6,451
  • 2
  • 42
  • 63
  • Get-WinEvent -Path E:\path\filename.evt does work, though only on Windows Vista/2008 R2 and higher OS. I have been trying to get this to work on a windows server 2003, but could not find anything on this yet. Am not really sure of remoting to a Win 2003 machine – whizkid Jun 06 '12 at 11:57