Search all Event Logs Within a Specific Timeframe with PowerShell

Adam Bertram

Adam Bertram

Read more posts by this author.

There are times when I’m asked to help troubleshoot some random, obscure problem that only occurs on the third Tuesday of every other month. No one can figure it out and no one has a clue what’s going on. The only thing they know is that it happened at some certain time.

One of the first activities any good admin does is check the logs at that time. What went on? What went wrong? Here’s how I do that with PowerShell.

This is a script to find all events in all event logs on a Windows computer that are within between two times. This is one I’ve used numerous times.


## Specify the timeframe you'd like to search between
$StartTimestamp = [datetime]'1-1-2014 00:00:00'
$EndTimeStamp = [datetime]'1-5-2014 06:00:00'

## Specify in a comma-delimited format which event logs to skip (if any)
$SkipEventLog = 'Microsoft-Windows-TaskScheduler/Operational'

## The output file path of the text file that contains all matching events
$OutputFilePath = 'C:\eventlogs.txt'

## Create the Where filter ahead of time to only get events within the timeframe
$filter = {($_.TimeCreated -ge $StartTimestamp) -and ($_.TimeCreated -le $EndTimeStamp)}

foreach ($c in $ComputerName) {
    ## Only get events from included event logs
    if ($SkipEventLog) {
        $op_logs = Get-WinEvent -ListLog * -ComputerName $c | Where {$_.RecordCount -and !($SkipEventLog -contains $_.LogName)}
    } else {
        $op_logs = Get-WinEvent -ListLog * -ComputerName $c | Where {$_.RecordCount}

    ## Process each event log and write each event to a text file
    $i = 0
    foreach ($op_log in $op_logs) {
        Write-Progress -Activity "Processing event logs" -status "Processing $($op_log.LogName) event log" -percentComplete ($i / $op_logs.count*100)
        Get-WinEvent $op_log.LogName -ComputerName $c | Where $filter |
            Select @{n='Time';e={$_.TimeCreated}},
                @{n='EventLog';e={$_.LogName}} | Out-File -FilePath $OutputFilePath -Append -Force

Subscribe to Adam the Automator

Get the latest posts delivered right to your inbox

Looks like you're offline!