Question

How do I export Windows Event logs for PowerShell using a PowerShell script?

Answer

Run the following in PowerShell ISE:

# Define the base path where you want to save the CSV file

$basePath = "C:\Temp"

# Get the current date and time in ISO format

$timestamp = (Get-Date).ToString("yyyy-MM-ddTHH-mm-ss")

# Construct the full file path with the timestamp

$csvPath = "$basePath\PowerShellEventLog_$timestamp.csv"

# Extract the directory path from the full file path

$directory = [System.IO.Path]::GetDirectoryName($csvPath)

# Check if the directory exists, and if not, create it

if (-not (Test-Path -Path $directory)) {

  New-Item -ItemType Directory -Path $directory -Force

}

# Export the event log to the CSV file

Get-EventLog -LogName "Windows PowerShell" | Select-Object TimeWritten, EntryType, Message | Export-Csv -Path $csvPath -NoTypeInformation