Get-WinEvent filterhashtable AND path?

PowerShell Help
1

This works Get-WinEvent -FilterHashtable @{logname=‘Application’} This doesn’t Get-WinEvent -path C:\somevent.evtx -FilterHashtable @{logname=‘Application’}. Does anyone know if you can specify a specific event log when filtering instead of the computers current one?

2

I have no clue how I missed this.
Get-winevent -FilterHashtable @{Path="C:\somevent.evtx; logname=‘Application’}
Anyways I simply needed to do the above to solve my issue.

3

You would just use -FilterHashtable and add a Path key to it:

Get-WinEvent -FilterHashtable @{ LogName = 'Application'; Path = 'C:\someevent.evtx' }

https://technet.microsoft.com/library/5fe94870-ed6b-4ce2-9500-93846cc65c95(v=wps.630).aspx has all the details. :slight_smile: