Question

Is there anyway to only output the description field in an event log entry?

Im current using:

wevtutil qe Application /q:*[System[(EventID=431)]] /f:text /rd:true /c:2 /gm:true > C  :\query.txt

However this output everything. I just want to output the description which is under:

<EventData> 
<Data> Description bllah blah</data> 
</EventData>

Answer 1

You can use /f:text modifier and grep with ^|FIND "Description"

wevtutil qe Application /q:*[System[(EventID=431)]] /f:text /rd:true /c:2 /gm:true ^|FIND "Description" > C:\query.txt

Note the ^ before the pipe, it escapes the pipe in scripts.