Query for error events in Event log using PowerShell

PowerShell has a built in cmdlet(Get-Eventlog) which directly interacts with Event Viewer. You can query the data in the way you want using this cmdlet. Below are some of the examples…

Get-Eventlog -logName System

This queries all events in System event.

Get-EventLog -LogName System | ? {$_.Entrytype -match “error” }

This queries all error events in System event viewer.

$fromtime = (get-date).Adddays(-1)

Get-EventLog -LogName System | ? {$_.Entrytype -match “error” -and $_.timegenerated -gt $fromtime }

This queries all error events in last one day. You can similarly use the methods of (get-date) to query events in last few seconds, minutes, hours, days, etc.