# Event log - how get event IDs of most frequent incidents?

**URL:** <https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900>\
**Category:** PowerShell Help\
**Created:** [July 23, 2019, 11:41am UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900 "2019-07-23T11:41:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredrikhedlund](https://avatars.discourse-cdn.com/v4/letter/f/97f17d/32.png) [@fredrikhedlund](https://forums.powershell.org/u/fredrikhedlund)\
**Post date:** [July 23, 2019, 11:41am UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/1 "2019-07-23T11:41:51Z")

</div>

Hi all!

I have made a script that reads the Windows event log for system/application and does some simple statistics for last 7 days.  
Number of errors for the period, as well as number of warnings etc.  
Works great!

—\> QUESTION: \<—  
How to write PowerShell code that shows which _Event IDs_ are the most _common_? Like a top ten list of warnings/errors or something like that.

Desired output would be something like this:

2019-07-22 ; 2019-07-15 ; EventID; 55 ;Frequency; 102  
2019-07-22 ; 2019-07-15 ; EventID; 123 ;Frequency; 56  
2019-07-22 ; 2019-07-15 ; EventID; 32 ;Frequency; 34

Start-date ; end-date ; EventID; XX ; Frequency ; YY

(\*) Frequence just means number of hits/occurences for that specific event-id. The top 5 or so would do just fine. But I need to measure out exactly which event id is the most common/hast the most hits/highest frequency/most occurences

What I have done so far is a foreach that counts up the event-id with increments of 1 at a time - but that is not very elegant and is way to slow (considering that theoretically the range would be 1-65535)

Any ideas?

Have a nice day!

---

<div class="post-metadata">

**Author:** ![kvprasoon](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/kvprasoon/32/4449_2.png) [@kvprasoon](https://forums.powershell.org/u/kvprasoon)\
**Post date:** [July 23, 2019, 12:08pm UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/2 "2019-07-23T12:08:12Z")

</div>

Cmdlets you would need are Get-WinEvent, Group-Object and a Foreach loop. Try to put some code after reading online help docs for these cmdlets.  
Share the code when you get stuck/error here… people will help.

---

<div class="post-metadata">

**Author:** ![nitbha](https://avatars.discourse-cdn.com/v4/letter/n/6a8cbe/32.png) [@nitbha](https://forums.powershell.org/u/nitbha)\
**Post date:** [July 23, 2019, 12:41pm UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/3 "2019-07-23T12:41:56Z")

</div>

@[fredrikhedlund38](https://powershell.org/profile/fredrikhedlund/) As per your details, you can use below code for the example:

**Code:**

```
$after=$(get-date).AddDays(-7)
$before=$(get-date)
group_indexs=Get-Eventlog -LogName System -After $after -Before $before | Where {$_.EntryType -match 'Warning|Error'} | Group-Object Index
foreach($group_index in $group_indexs){ 
write-host "Start-date:"$($after.tostring("yyy-MM-dd"))" End-date:"$($before.tostring("yyy-MM-dd"))" Frequency:$($($group_index).count) EventID:$($($group_index).Name)" 
}
```

---

<div class="post-metadata">

**Author:** ![fredrikhedlund](https://avatars.discourse-cdn.com/v4/letter/f/97f17d/32.png) [@fredrikhedlund](https://forums.powershell.org/u/fredrikhedlund)\
**Post date:** [July 23, 2019, 12:48pm UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/4 "2019-07-23T12:48:53Z")

</div>

[quote quote=167389]Cmdlets you would need are Get-WinEvent, Group-Object and a Foreach loop. Try to put some code after reading online help docs for these cmdlets.

Share the code when you get stuck/error here… people will help.

[/quote]

Thanks!  
This solved my problem - I think!

This is what I came up with:

```
### PowerShell version 2.0 (1.0?)

# Read from disk once

$systemerror = get-eventlog -LogName SYSTEM -EntryType Error -After (get-date).adddays(-8) -before (get-date).adddays(-1)

# count,name (name = event id)
$systemerror | Group-Object -Property InstanceID

### PowerShell version 3.0, 4.0, 5.1

# Read from disk once

$systemerror = Get-WinEvent -filterhashtable @{
LogName='SYSTEM';
Level='2';
StartTime=(get-date).adddays(-8);
EndTime=(get-date).adddays(-1);
}

# count,name (name = event id)
$systemerror | Group-Object -Property ID | Select-Object Count,Name
```

---

<div class="post-metadata">

**Author:** ![fredrikhedlund](https://avatars.discourse-cdn.com/v4/letter/f/97f17d/32.png) [@fredrikhedlund](https://forums.powershell.org/u/fredrikhedlund)\
**Post date:** [July 23, 2019, 1:05pm UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/5 "2019-07-23T13:05:26Z")

</div>

Thanks! Ill check it out!

Just for curiosity, where is that $hasharray used? I cant see where?

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:31pm UTC](https://forums.powershell.org/t/event-log-how-get-event-ids-of-most-frequent-incidents/12900/6 "2024-05-16T20:31:55Z")

</div>