Hello,

I’ll show you a nice way to use the “Get-WinEvent” cmdlet, to query EventLog very efficiently.

Example, if I want to know when my computer rebooted, and if there are pending reboot, I can use :

Get-WinEvent -FilterHashtable @{'Logname'="System";'ID'=1074,22;'Level'="4"}

If I want the output more readable, I can sort data by Time Like this :

Get-WinEvent -FilterHashtable @{'Logname'="System";'ID'=1074,22;'Level'="4"}  -MaxEvents 5 | Sort-Object TimeCreated -Descending

All of this can be done remotely by using the “-ComputerName” parameter.

This is just an overview to show you how to use the [HashTable] to query EventLog incredibly fast, if you want more details, feel free to use :

Get-Help Get-WinEvent -ShowWindow