Pixal
August 11, 2022, 4:55am
1
If I was running the following;
get-eventlog -logname system -newest 15 | select -property eventID, timewritten, message | sort -property timewritten | convertto-html | out-file c:\error.htm
but wanted to collect the logs from say example 15 surface pro devices all at once which are all connected on the same domain what further do I need to build into the above to pull out all devices logs.
Olaf
August 11, 2022, 6:57am
2
Marcus,
Welcome to the forum.
For the next time … When you post code, sample data, console output or error messages please format it as code using the preformatted text button ( </> ). Simply place your cursor on an empty line, click the button and paste your code.
Thanks in advance
How to format code in PowerShell.org <---- Click
When you carefully (re-)read the help for Get-EventLog
you will learn that it can query the event log from multiple computers at once by itself.
The Get-EventLog cmdlet gets events and event logs from local and remote computers. By default, Get-EventLog gets logs from the local computer. To get logs from remote computers, use the ComputerName parameter. You can use the Get-EventLog parameters...
So - if that works for you - you just have to add the parameter -ComputerName ...
with the list of computernames you want to query and you’re done.
But when you read the help carefully you will learn as well that the cmdlet is based on a deprecated API and should not be used anymore.
The successor would be Get-WinEvent
This cmdlet is only available on the Windows platform. The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs. The cmdlet gets data from event logs that are generated by the Windows Event...
Unfortunately in this case the new cmdlet does not support to query multiple computers at once. So you need a loop.
Something like this should work
$ComputerNameList = 'ComputerName1', 'ComputerName2'
$Result =
foreach ($ComputerName in $ComputerNameList) {
Get-WinEvent -LogName System -MaxEvents 15 -ComputerName $ComputerName |
Select-Object -Property MachineName, ID, timecreated, message |
Sort-Object -Property MachineName, timecreated
}
$Result |
convertto-html |
out-file c:\error.htm