Get-WinEvent is very very slow - More thant 45 minutes searching for event 4729 in a 1 million event log (512 MB size) - Super Hardware

Question

Someone removed a user from a group, we´re tryingo to track down, who made it
I´m using:
get-eventlog -LogName security -ComputerName SERVERNAME | Where-Object {$_.EventID -eq 4729} | Export-Csv -Path c:\temp\SERVERNAME_4729.log -NoTypeInformation
or
get-eventlog -LogName security -ComputerName SERVERNAME | Where-Object {$_.EventID -eq 4729}
The DC have 4 GB of RAM, 4 vCPUs in a Dell PE R420 with SAS 15K disks, it´s very fast hardware/response time
The DC have more than 955.000 events in the last 15 days, 512 MB file size for the .EVTX
The search takes more than 45 minutes to finish
It´s acceptable? I have the felling that this procedure will take no more than 5 minutes to do the search and grab the results

Answer 1

This will be much faster:
get-eventlog -LogName security -ComputerName SERVERNAME -InstanceID 4729 |
     Export-Csv -Path c:\temp\SERVERNAME_4729.CSV -NoTypeInformation
The method you used returns every record in the log then filters.  This method filters the remote search remotely and in the query.  It only returns records that have that ID.
¯\_(ツ)_/¯