Powershell script to search specific event ID's from Archive Event files

Question

Hi,
I have to search some Windows Event ID's from Archive event (evtx) files. for that i am trying powershell code mentioned on below link but its not working. Kindly suggest how to search specific event id from archive logs.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/83cbf185-bd96-4efc-b36b-59439024960a/parse-message-property-from-archived-eventlog
Regards,
Dhiraj

Answer 1

Hi,
Thanks for your response. I am using below code & getting below message. I changed the event ID & got some results. Can we remove those lines form results where record not found. like how can we get only those records which match given
event ID. also it's not showing all field values. Is there any formating issue.
$SearchID='4740' 
get-childitem "C:\Windows\System32\Winevt\Logs\Archive-Security*.evtx" | select FullName | forEach{
 %{get-winevent  -filterHashTable @{path=$_.Fullname;ID=$SearchID} |                
    ? {$_.Properties[5].Value -match $UserName} |   
    Select-Object -Property TimeCreated, `
                            @{Name='SecurityId';Expression={$_.Properties[4].Value}}, `
                            @{Name='AccountName';Expression={$_.Properties[5].Value}}, `
                            @{Name='AccountDomain';Expression={$_.Properties[6].Value}}, `
                            @{Name='LogonId';Expression={$_.Properties[7].Value}}, `
                            @{Name='LogonType';Expression={$_.Properties[8].Value}}, `
                            @{Name='Workstation';Expression={$_.Properties[11].Value}}, `
                            @{Name='LogonGuid';Expression={$_.Properties[12].Value}} |
    Format-Table
Get-WinEvent : No events were found that match the specified selection criteria.
At C:\Users\sidadmin1\Documents\EventIDCheck.ps1:3 char:16
+  %{get-winevent <<<<   -filterHashTable @{path=$_.Fullname;ID=$SearchID} |
    + CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
    + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand
TimeCreated    SecurityId     AccountName     AccountDomain LogonId        LogonType      Workstation    LogonGuid
3/11/2014 4... DC04$          MyDomain                 999
Get-WinEvent : No events were found that match the specified selection criteria.
At C:\Users\sidadmin1\Documents\EventIDCheck.ps1:3 char:16
+  %{get-winevent <<<<   -filterHashTable @{path=$_.Fullname;ID=$SearchID} |
    + CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
    + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand
Dhiraj