Windows PowerShell is a powerful scripting language that allows users to automate and manage tasks in Windows. The Get-Event command is one of the most useful commands in the Windows PowerShell language. It can be used to retrieve events from the event log, filter them, and display them in a readable format. In this article, we will discuss the syntax, parameters, inputs, outputs, examples, and tips for using the Get-Event command in Windows PowerShell.
Syntax of the Get-Event Command
The syntax of the Get-Event command is as follows:
Get-Event [-LogName] <string> [-Source] <string[]> [-ComputerName <string[]>] [-Credential <PSCredential>] [-MaxEvents <int>] [-Oldest] [-Newest] [-UserName <string[]>] [-Message <string>] [-Category <int[]>] [-EntryType <string[]>] [-InstanceId <long[]>] [-Index <int[]>] [-Id <int[]>] [-Level <int[]>] [-Keywords <long[]>] [-Task <int[]>] [-ProviderName <string[]>] [-ProviderGuid <Guid[]>] [-After <datetime>] [-Before <datetime>] [-Culture <string>] [-IncludeProviderManifest] [-ExcludeProviderManifest] [-Force] [-AsJob] [-ThrottleLimit <int>] [-AsString] [-FilterXPath <string>] [-FilterXml <XmlDocument>] [-FilterHashtable <hashtable>] [-FilterXmlFragment <XmlNode>] [-FilterXPathFragment <string>] [-FilterScript <scriptblock>] [-FilterScriptFragment <scriptblock>] [-FilterEventId <int[]>] [-FilterData <string[]>] [-FilterPath <string[]>] [-FilterLink <string[]>] [-FilterUser <string[]>] [-FilterOpCode <int[]>] [-FilterProcessId <int[]>] [-FilterKeywords <long[]>] [-FilterTask <int[]>] [-FilterLevel <int[]>] [-FilterProviderName <string[]>] [-FilterProviderGuid <Guid[]>] [-FilterLogName <string[]>] [-FilterCategory <int[]>] [-FilterEntryType <string[]>] [-FilterMessage <string>] [-FilterInstanceId <long[]>] [-FilterIndex <int[]>] [-FilterId <int[]>] [-FilterProperty <string[]>] [-FilterValue <object[]>] [-FilterTimeCreated <datetime[]>] [-FilterActivityId <Guid[]>] [-FilterRelatedActivityId <Guid[]>] [-FilterContainerLog <string[]>] [-FilterContainerName <string[]>] [-FilterContainerSource <string[]>] [-FilterContainerLevel <int[]>] [-FilterContainerEntryType <string[]>] [-FilterContainerMessage <string>] [-FilterContainerInstanceId <long[]>] [-FilterContainerIndex <int[]>] [-FilterContainerId <int[]>] [-FilterContainerProperty <string[]>] [-FilterContainerValue <object[]>] [-FilterContainerTimeCreated <datetime[]>] [-FilterContainerActivityId <Guid[]>] [-FilterContainerRelatedActivityId <Guid[]>] [-FilterContainerKeywords <long[]>] [-FilterContainerTask <int[]>] [-FilterContainerOpCode <int[]>] [-FilterContainerProcessId <int[]>] [-FilterContainerUser <string[]>] [-FilterContainerCategory <int[]>] [-FilterContainerData <string[]>] [-FilterContainerLink <string[]>] [-FilterContainerPath <string[]>] [-FilterContainerUserName <string[]>] [-FilterContainerProviderName <string[]>] [-FilterContainerProviderGuid <Guid[]>] [-FilterContainerLevelDisplayName <string[]>] [-FilterContainerTaskDisplayName <string[]>] [-FilterContainerOpCodeDisplayName <string[]>] [-FilterContainerKeywordsDisplayName <string[]>] [-FilterContainerCategoryDisplayName <string[]>] [-FilterContainerPropertyName <string[]>] [-FilterContainerValueType <string[]>] [-FilterContainerValueTypeName <string[]>] [-FilterContainerValue <object[]>] [-FilterContainerTimeCreatedDisplayName <string[]>] [-FilterContainerActivityIdDisplayName <string[]>] [-FilterContainerRelatedActivityIdDisplayName <string[]>] [-FilterContainerUserNameDisplayName <string[]>] [-FilterContainerProviderNameDisplayName <string[]>] [-FilterContainerProviderGuidDisplayName <string[]>] [-FilterContainerLogDisplayName <string[]>] [-FilterContainerNameDisplayName <string[]>] [-FilterContainerSourceDisplayName <string[]>] [-FilterContainerMessageDisplayName <string[]>] [-FilterContainerInstanceIdDisplayName <string[]>] [-FilterContainerIndexDisplayName <string[]>] [-FilterContainerIdDisplayName <string[]>] [-FilterContainerDataDisplayName <string[]>] [-FilterContainerLinkDisplayName <string[]>] [-FilterContainerPathDisplayName <string[]>] [-FilterContainerPropertyNameDisplayName <string[]>] [-FilterContainerValueTypeDisplayName <string[]>] [-FilterContainerValueDisplayName <string[]>] [-FilterContainerTimeCreatedFilter <string>] [-FilterContainerActivityIdFilter <string>] [-FilterContainerRelatedActivityIdFilter <string>] [-FilterContainerUserNameFilter <string>] [-FilterContainerProviderNameFilter <string>] [-FilterContainerProviderGuidFilter <string>] [-FilterContainerLogFilter <string>] [-FilterContainerNameFilter <string>] [-FilterContainerSourceFilter <string>] [-FilterContainerMessageFilter <string>] [-FilterContainerInstanceIdFilter <string>] [-FilterContainerIndexFilter <string>] [-FilterContainerIdFilter <string>] [-FilterContainerDataFilter <string>] [-FilterContainerLinkFilter <string>] [-FilterContainerPathFilter <string>] [-FilterContainerPropertyNameFilter <string>] [-FilterContainerValueTypeFilter <string>] [-FilterContainerValueFilter <string>] [-FilterContainerTimeCreatedLabel <string>] [-FilterContainerActivityIdLabel <string>] [-FilterContainerRelatedActivityIdLabel <string>] [-FilterContainerUserNameLabel <string>] [-FilterContainerProviderNameLabel <string>] [-FilterContainerProviderGuidLabel <string>] [-FilterContainerLogLabel <string>] [-FilterContainerNameLabel <string>] [-FilterContainerSourceLabel <