# Powershell Script help : Windows events to Query and export

**URL:** <https://forums.powershell.org/t/powershell-script-help-windows-events-to-query-and-export/1265>\
**Category:** PowerShell Help\
**Created:** [December 31, 2011, 6:30pm UTC](https://forums.powershell.org/t/powershell-script-help-windows-events-to-query-and-export/1265 "2011-12-31T18:30:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![archives](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@archives](https://forums.powershell.org/u/archives)\
**Post date:** [December 31, 2011, 6:30pm UTC](https://forums.powershell.org/t/powershell-script-help-windows-events-to-query-and-export/1265/1 "2011-12-31T18:30:00Z")

</div>

by hunboy at 2012-11-06 19:01:53

> I have below powershell script for windows events to query, trying to write this script to get the Compueter name, Event ID, Source and description info to excel.  
>   
> Looking for help to finish this script. This script to run on list of computers also.  
>   
>   
> `$servers = get-content “c:\list.txt”foreach ($server in $servers){$serverGet-EventLog -LogName APPLICATION |Source "ACECLIENT" AND Where-Object { $.EventID -eq 1001 } # I am not sure how to include here description "looking for ‘File not found: C:\Program Files\Microsoft ISA Server\SDCONFIG.’" }`

_by hunboy at 2012-11-06 23:18:22_

> _I have done small changes to get the last five days events only but the script not showing any results… Can any one help me here… pls…_  
>   
> _[code2=powershell]$servers = get-content “C:\list.txt”  
> $OututPath="C\OUTPUT.csv"  
> $fromtime = (get-date).Adddays(-5)  
> get-eventlog -log Application -comp $servers | where {$_.source -eq "Defrag" -AND $_.EventID -eq 258 -and $_.message -like "_The disk defragmenter successfully_" -AND $_.TimeGenerated -EQ $FROMTIME } | Export-Csv $OututPath -NoTypeInformation_  
>   
> _# The Problem is I want to get the events for only last 5 days, When i added "-AND $_.TimeGenerated -EQ $FROMTIME" the output is not comming it is taking lot of time but not results. I think some logic problem… Can any one help me here…[/code2]

by Klaas at 2012-11-07 00:42:39

> Have you tried building up your script step by step; get the eventlog from one computer, output to the screen,… and see which steps work and which doesn’t?  
>   
> Also, try to filter as soon as you can. The get-eventlog has a -source and a -after parameter, so it’s probably better to use those instead of piping all events and then filtering them with the Where-Object. There even is a -message parameter.  
> The source on my system is called 'Microsoft-Window-Defrag"  
> `Get-Eventlog -ComputerName MyPC -Logname Application -After $fromtime -Source "microsoft-windows-defrag"`  
> Do you get any output from that?  
>   
> I also think your $Oututpath needs a colon : "C]\OUTPUT.csv"

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:57pm UTC](https://forums.powershell.org/t/powershell-script-help-windows-events-to-query-and-export/1265/2 "2024-05-16T20:57:59Z")

</div>