> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Find a Specific Event ID in the Event Log
- URL: https://www.filipkonopik.com/powershell-find-a-specific-event-id-in-the-event-log/
- Published: 2026-07-27T10:09:17.000Z
- Updated: 2026-08-06T05:44:07.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to search for a specific type of event - a particular error, warning, or system action - without scrolling through the entire log manually? This one-liner filters directly by Event ID.

Prerequisites:

Prerequisites:

- Privileges: None (for System and Application logs; Security log requires Administrator)
- Module: Built-in, no import needed

Quick Command:

```Powershell
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074} -MaxEvents 5
```

Example Output:

```Powershell
ProviderName: User32
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
7/17/2026 1:49:54 PM           1074 Information      The process C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperience...
7/14/2026 11:24:53 PM          1074 Information      The process C:\WINDOWS\servicing\TrustedInstaller.exe (PC-IT-01) initiated...
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- \-FilterHashtable filters the log directly at the query level for a specific Event ID, instead of pulling every event and filtering afterward - far more efficient, especially on logs with thousands of entries.
- LogName='System' specifies which log to search - common options are System, Application, and Security, and the correct one depends on which ID you're looking for (most IDs are tied to a specific log, not universal across all three).
- Id=1074 is the specific Event ID being searched for - replace this with whatever ID is relevant to what you're investigating.
- \-MaxEvents 5 limits the output to the most recent matches, since some Event IDs can have a large number of entries.