Solved: Get-WinEvent Powershell Export To txt File

Create Account

Powershell

Questions

Followers

Top Experts

jonathanbyers🇺🇸

Get-WinEvent Powershell Export To txt File

I want to output the Message column from the latest event log in the Microsoft-Windows-Backup event log. I see the log when running Get-WinEvent Microsoft-Windows-Backup but don't know how to output ONLY the latest message to a text file.

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

Navdeep🇸🇬

Hi
Try this

get-winevent microsoft-windows-backup | Select-Object Messages -First 100

jonathanbyers🇺🇸

ASKER

Nope. I have

get-winevent Microsoft-Windows-Backup -MaxEvents 1

which returns the last event, but I'm trying to get each column into its own text file so a monitoring application can check each output for criteria.

FDiskWizard🇺🇸

That could be a problem I think. On my workstation for example I ran:
Get-WinEvent Microsoft-Windows-Backup

I got 3 entries (from a while back):
2:35:53 PM Completed
2:35:53 PM Cancelled
2:31:29 PM Started

So if you just view the last one, it just shows it finished, but not the outcome.

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.

jonathanbyers🇺🇸

ASKER

What OS are you running. I am testing on Windows 7 x64 and Windows 2008 R2. Both have the same output.
Output.jpg

FDiskWizard🇺🇸

Windows 7. I was just pasting the basic info.

Yours looks about the same, but it is cutting off the Completed, Failed, Started part...
I would think you would have to look for the success/failed/cancelled parts. Cancelled could be by user, or say for instance the backup device dies.

From mine:

Id Message
-- -------
14 The backup operation has completed.
8 The backup operation was canceled.
1 The backup operation has started.

Navdeep🇸🇬

Hi,

I ran the same command which i gave you and following are the results

you can then pipe the results to csv file using Export-CSV -noTypeInformation

Alternatively you can use the following code however you need to add where-object to select specified results for example show event from 12/01/2012 14:00

Get-EventLog Application | %{write-host $_.Message}

Get a FREE t-shirt when you ask your first question.

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.

jonathanbyers🇺🇸

ASKER

OK Get-WinEvent Microsoft-Windows-Backup | %{write-host $_.Message} is working!, but is there anyway to limit it to only display events from the current day?

ASKER CERTIFIED SOLUTION

jonathanbyers🇺🇸

ASKER

membership

Signing up is free and takes 30 seconds. No credit card required.

Create Account

jonathanbyers🇺🇸

ASKER

This returns the message field for the current day only.

Powershell

Questions

Followers

Top Experts

Windows PowerShell is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and associated scripting language built on the .NET Framework. PowerShell provides full access to the Component Object Model (COM) and Windows Management Instrumentation (WMI), enabling administrators to perform administrative tasks on both local and remote Windows systems as well as WS-Management and Common Information Model (CIM) enabling management of remote Linux systems and network devices.