Search code examples
powershellevent-viewer

How to specify that I want Microsoft Office Alerts messages from Get-WinEvent?


So I'm trying to take all of the Microsoft Office Alerts messages from Event Viewer, and put them into a .txt file using Powershell ISE. I'm adapting this from previous code, which wanted to export all of a DIFFERENT type of Event Viewer message (that previous version worked successfully). Then I would like to only take a specific message (say, PDF Reflow related ones), and put them into another .txt file.

Currently I have,

Get-WinEvent Microsoft Office Alerts* > .\Documents\ErrorTestFile1.txt # Should retrieve ALL Microsoft Office Alerts messages, and put them into ErrorTestFile.txt
Get-Content .\Documents\ErrorTestFile1.txt | Select-String "PDF Reflow" > .\Documents\ErrorTestFileFinal.txt # Should take messages contained "PDF Reflow" in their string, and put them into ErrorTestFileFinal.txt

Powershell gives me an error that makes it seem like using "Microsoft Office Alerts*" is the incorrect way to point it there.

Thank you all


Solution

  • "Microsoft Office Alerts*" is indeed the wrong log name. You are looking for "OAlerts":

    Get-WinEvent -LogName OAlerts | Where-Object {$_.Message -ilike "*PDF Reflow*"} | Select-Object -Property * > .\Documents\ErrorTestFileFinal.txt
    

    This will pipe all information about each desired event into your textfile. You can be more specific in the Select-Object cmdlet to restrict it to fewer properties.