Question

Is it possible to filter event logs by its codes range, or inequality using filterhashtable? Something like:

$filter = @{
    LogName = 'application'
    Level = 2,3
    ID = isBetween 2000 and 4000 and -ne 3333 => ?
}
Get-WinEvent -FilterHashtable @filter
Was it helpful?

Solution

According to the documentation ID must be a list of integers only.

-- ID=<Int32[]>

OTHER TIPS

As Andy has said, ID needs to be a list of numbers, but you can build the ID number list yourself (I had previously posted an incomplete answer but have fixed my own code).

The following should do the trick:

[int32[]]$ID = @(2000..3332 + 3334..4000)
$filter = @{Logname='Application';
            Level=2,3;
            ID=$ID}
Get-WinEvent -FilterHashtable $filter
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top