# Get 5 Events from this log

**URL:** <https://forums.powershell.org/t/get-5-events-from-this-log/16654>\
**Category:** PowerShell Help\
**Created:** [May 25, 2021, 10:38pm UTC](https://forums.powershell.org/t/get-5-events-from-this-log/16654 "2021-05-25T22:38:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [May 25, 2021, 10:38pm UTC](https://forums.powershell.org/t/get-5-events-from-this-log/16654/1 "2021-05-25T22:38:15Z")

</div>

I have this script:

```auto
$DCs = [DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() |
    Select-Object -ExpandProperty Sites |
        Select-Object -ExpandProperty Servers |
            Select-Object -ExpandProperty Name

$results = Invoke-Command -ComputerName $DCs {
    Get-EventLog -LogName 'DFS Replication' -Newest 100 | Where-Object {$_.EventID -eq 1206} |
        Select-Object "EventID","MachineName","Message","TimeGenerated"
}

$results | Export-Csv -Path .\AllDCs_DFSLogs.csv -NoTypeInformation

```

…I really only want the first 5 events of that particular EventID. I put in “100” to cull through the log to at least find them, but how do I winnow exactly the ‘latest 5 of that EventID’?

thank you

---

<div class="post-metadata">

**Author:** ![Olaf](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/olaf/32/992_2.png) [@Olaf](https://forums.powershell.org/u/Olaf)\
**Post date:** [May 25, 2021, 11:02pm UTC](https://forums.powershell.org/t/get-5-events-from-this-log/16654/2 "2021-05-25T23:02:36Z")

</div>

JT,

`Get-Eventlog` is deprecated. Do not use it anymore. You should use `Get-WinEvent` instead.

> **[Get-WinEvent (Microsoft.PowerShell.Diagnostics) - PowerShell](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.2&viewFallbackFrom=powershell-7.1)**
>
> This cmdlet is only available on the Windows platform. The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs. The cmdlet gets data from event logs that are generated by the Windows Event...

How about this:

```auto
$results = 
Invoke-Command -ComputerName $DCs {
    $FilterHashTable = @{
        LogName = 'System'
        ID = 43
    }
    Get-WinEvent -FilterHashtable $FilterHashTable |
    Select-Object -Property ID, MachineName, Message, TimeCreated -First 5 
}

```

---

<div class="post-metadata">

**Author:** ![jeff-taylor](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/jeff-taylor/32/1015_2.png) [@jeff-taylor](https://forums.powershell.org/u/jeff-taylor)\
**Post date:** [May 25, 2021, 11:51pm UTC](https://forums.powershell.org/t/get-5-events-from-this-log/16654/3 "2021-05-25T23:51:58Z")

</div>

Works great thanks Olaf

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:24pm UTC](https://forums.powershell.org/t/get-5-events-from-this-log/16654/4 "2024-05-16T20:24:28Z")

</div>