PowerShell: Export Event Log to CSV
Need to export Event Log entries to a CSV file - for sharing with a team, archiving, or analyzing in Excel? This one-liner pulls the events and saves them directly to a file.
Prerequisites:
- Privileges: None (for System and Application logs; Security log requires Administrator)
- Module: Built-in, no import needed
Quick Command:
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5 | Export-Csv -Path "C:\EventLog.csv"📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-WinEvent -FilterHashtable filters the log for specific events - here, Event ID 1074 from the System log - the same filtering approach covered in the general Event ID lookup article.
- -MaxEvents 5 limits how many events get pulled, since exporting an entire unfiltered log could result in a massive file.
- | Export-Csv -Path "C:\EventLog.csv" pipes the filtered events into Export-Csv, which writes them to a CSV file at the specified path - by default, this produces no output in the terminal, since the result goes straight to the file instead.