Question

I have a Windows Event Log file (.evt/.evtx) and I want to select a particular event from the Event Log using power shell. I see cmdlets like

$provider = Get-WinEvent -listprovider $EventSource
$ProviderEvent = $provider.events | Where-Object {($_.ID -eq 4)}

to query the event log, but in my .evtx, there are multiple events with same ID.

Hence, my question is – how to pin point to an individual event, (using what fields)?

Answer 1

Check the RecordId property:

$provider.events | Where-Object {$_.ID -eq 4} | foreach {$_.RecordId}