How to export Windows Event logs with PowerShell

If you have administrative privileges in Windows, you can export Windows Event Logs using PowerShell with just two commands. There are several ways to do this simple task, depending on the version of Windows, using the Get-WinEvent or Get-EventLog cmdlet.

How to use PowerShell to export System Event logs

Using PowerShell, you can extract Even logs by following these three instructions.

Using Get-WinEvent

The usage of Get-EventLog

Using wevtutil to get raw EVTX data

This can be run from either Windows Terminal or PowerShell.

You can leverage Get-WinEvent to export the system log to a.csv file:

Run the following command: Get-WinEvent -LogName System | Export-Csv -Path "C:LogSystemLog.csv" -NoTypeInformation

LogName System is the system logs that are exported in CSV format.

If you want a.csv file with the logs from the last 24 hours:

run Get-WinEvent with parameters LogName, Application, and StartTime Get-Date ****Export-Csv -Path "C:LogsApplicationLastDay.csv" -NoTypeInformation****, AddDays(-1) **** Directly export the application log to a text file using Get-EventLog:

"C:LogApplicationLog.txt" This is the path to the log file for the application as specified by the "LogName Application" parameter in the Get-EventLog command. The output will be saved as a simple text file.

See: Windows Event Log Deletion Guidance

Subject: Full EVTX Logs Using wevtutil-

The Windows Event Log service uses its own proprietary format,.evtx, to store files known as Windows Event Logs or EVTX files. They store information about events that the OS and applications create, such as system events, application problems, and security audits.

Security "C:LogsSecurityLog.evtx" created by wevtutil epl.

Here, "EPL" is the export log. The above command will output the logs in the default, raw EVTX format. One good thing about generating an EVTX file is that it can be directly opened in the event viewer.

Best regards.

How to open an EVTX file?

EVTX file format can be opened and studied with several different programs. Among the most frequent ways of viewing and comprehending the event logs, one should mention the Event Viewer tool, integrated into Windows. You will be able to load an EVTX file externally with Event Viewer by pressing Win + R, typing in eventvwr, and then select "Open Saved Log" from within it.

With these steps, you will definitely be able to export Windows event logs with PowerShell easily.