search in saved eventlog-file with powershell

Question

I have got some saved eventlogfiles (*.evtx). I want to search the ml-data for a specific textstring.

I found this solution for the current system eventlog:

Get-EventLog -LogName APPLICATION -After 04/01/2018 | Where-Object { $_.Message -like '*AVAST*' }

Is it possible to search a saved eventlog file with this string?

Nas · Accepted Answer · 2018-09-14 06:21:41Z

1

Use the Get-WinEvent cmdlet,

Get-WinEvent -Path C:\file.evtx | Where-Object { $_.Message -like '*AVAST*' }

answered Sep 14, 2018 at 6:21

Nas

1,2637 silver badges7 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1