Get-WinEvent troubleshooting examples

## Various 1 liners to get all events from all event logs/providers in given time ranges
## Further filtering can be applied via the grid view or pipe through Where-Object before Out-Gridview

## Message can have line breaks so replace those with a space to help show all text

Get-WinEvent -FilterHashtable @{ LogName = '*' ; StartTime = [datetime]::Now.AddMinutes( -5 ) } -Oldest  -EA 0 | select timecreated,leveldisplayname,id,logname,providername,@{Name='Message';Expression={$_.Message  -replace "`n`r?" , ' ' }}|Out-Gridview

## Show only error or warning events in a given time window (eg logon) - use date format for your locale

Get-WinEvent -FilterHashtable @{ LogName = '*' ; StartTime = "08:30 26/03/2023" ; EndTime = "08:45 26/03/2023" ; Level = 1,2,3 } -Oldest -EA 0 | select timecreated,leveldisplayname,id,logname,providername,@{Name='Message';Expression={$_.Message  -replace "`n`r?" , ' ' }}|Out-Gridview

## Show only error or warning events for today for Citrix event providers

Get-WinEvent -FilterHashtable @{ ProviderName = 'Citrix*' ; StartTime = [datetime]::Today ; Level = 1,2,3 } -Oldest -EA 0 | select timecreated,leveldisplayname,id,logname,providername,@{Name='Message';Expression={$_.Message  -replace "`n`r?" , ' ' }}|Out-Gridview

## Show only warnings/error where "Citrix" is in the message text (can do this in a grid view too)

Get-WinEvent -FilterHashtable @{ LogName = '*' ; StartTime = [datetime]::Now.AddMinutes( -95 ) } -Oldest  -EA 0 | select timecreated,leveldisplayname,id,logname,providername,@{Name='Message';Expression={$_.Message  -replace "`n`r?" , ' ' }}|Where Message -match 'Citrix'|Out-Gridview