GIST – Filter Windows Eventlog Messages By Log, Event ID, and Message


  • Share on Pinterest
$startDate = (Get-Date -Year 2023 -Month 8 -Day 1).Date # .Date makes it midnight
$endDate = (Get-Date -Year 2023 -Month 8 -Day 20).Date
Get-WinEvent -FilterHashtable @{logname = 'Application'; id = 4} -MaxEvents 25 | Where-Object { $_.Timecreated -ge $startDate -and $_.Timecreated -lt $endDate } | where message -match "Message to find" | Format-Table -wrap