0%

0/1 Lessons

Course Introduction

• 5min

0 / 2 lessons complete

Getting Started with Windows PowerShell

• 56min

0 / 8 lessons complete

Getting Help and Finding Commands

• 39min

0 / 6 lessons complete

PowerShell Command Syntax

• 33min

0 / 5 lessons complete

PowerShell Objects and Properties

• 35min

0 / 6 lessons complete

The PowerShell Pipeline

• 24min

0 / 2 lessons complete

PowerShell Providers

• 30min

0 / 5 lessons complete

PowerShell Arrays and Variables

• 28min

0 / 4 lessons complete

PowerShell Loops

• 19min

0 / 3 lessons complete

PowerShell Conditional Statements

• 11min

0 / 1 lessons complete

On Premises Lab Setup

• 36min

0 / 8 lessons complete

Basic Domain Administration with Windows PowerShell

• 2hr 27min

0 / 10 lessons complete

Send Emails with PowerShell

• 22min

0 / 2 lessons complete

PowerShell Desired State Configuration (DSC) Basics

• 1hr 48min

0 / 6 lessons complete

PowerShell Modules

• 58min

0 / 7 lessons complete

Powershell Challenges

• 1hr 55min

0 / 23 lessons complete

Course Conclusion

• 1min

0 / 1 lessons complete

How to Export Logs to a CSV File Answer

Instructions

Q&A (0)

Notes (0)

Resources (0)

Saving Progress...

Resources

There are no resources for this lesson.

Notes can be saved and accessed anywhere in the course. They also double as bookmarks so you can quickly review important lesson material.

Create note

Get Data from the Event Viewer then Export to a .CSV

In this lecture we will use PowerShell to get the data from the local computer’s Application event log, then export the data to a file called Event.csv. You should have already created the C:\temp folder.

Open PowerShell ISE in admin mode.
Go ahead and copy and paste the Get-WinEvent command into PowerShell

Here is the Command:

Get-WinEvent -LogName "Application" | Export-Csv -Path "C:\Temp\EventLog.csv"

This PowerShell one-liner retrieves event log entries from the "Application" log and exports them to a CSV (Comma-Separated Value) file named "EventLog.csv" to the C:\Temp folder.

Let's break down the command step by step:

Explanation:

Get-WinEvent: This cmdlet is used to retrieve event log entries from one or more event logs on a Windows computer. In this case, we're using it to access the "Application" log. The -LogName parameter specifies which log to query.

-LogName "Application": This part of the command specifies that we want to retrieve events from the "Application" event log. You can view other logs as well, like the Security, and System, and DNS server logs and more.

| (Pipe Operator): The pipe operator | is used to take the output of the Get-WinEvent cmdlet and send it as input to another cmdlet or operation. In this case, it sends the event log entries retrieved by Get-WinEvent to the next part of the command.

Export-Csv: This cmdlet is used to export data to a CSV file. It takes the input received from the previous cmdlet (Get-WinEvent) and exports it to a CSV file.

-Path "C:\Temp\EventLog.csv": This part of the command specifies the path and filename for the CSV file where the event log data will be saved. In this case, it's saving the CSV file as "EventLog.csv" in the folder C:\Temp.
So, when you run this one-liner, PowerShell will query the "Application" event log, retrieve the event log entries from that log, and then export them to a CSV file named "EventLog.csv" to the C:\Temp folder.

The resulting CSV file will contain information from the "Application" event log, including details such as event IDs, timestamps, event sources, and other relevant data. This can be useful for analyzing and troubleshooting application-related events on the system.

Let’s go ahead and open the Eventlog.csv and you see there is all kinds of information here. Let’s move some columns to make this more readable. In the first column you have the Message column, Event ID, LogName (Application log) , Time created
It takes a few minutes to run this command, the reason is that If you scroll the whole way down you see over 20,000 entry’s of application related information. We will learn in another lecture how to search the logs for Just ID specific data.

Server Academy Members Only

Sorry, this lesson is only available to Server Academy Full Access members. Become a Full-Access Member now and you’ll get instant access to all of our courses.

0 0 votes
Lesson Rating
Subscribe
Notify of
profile avatar
0 Comments
Inline Feedbacks
View all comments