First of all, you must locate the event log you want to export among all others.
For this, you can use the
Get-WmiObject cmdlet to list them all. Additionally, you can narrow down your list with the
Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -Match 'system'
Then you can assign your file to a variable and use the BackupEventlog method.
For example, if I want to export or backup the System event log.
$log = Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -EQ 'system' $log.BackupEventlog('e:\temp\system.evtx')
But as I just explained on StackOverflow you can also perform the whole operation as a oneliner and you will get the same result.
(Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -EQ 'System').BackupEventlog('E:\Temp\System.evtx')
2 thoughts on “How to backup/export an event log to an evtx file with PowerShell”
Any hint on how to get a Time Range into this Script?
This WMI object is only intended to handle the whole log file and not its content.
Thus if you want to filter events inside you have to use other methods like the Get-Winevent cmdlet, but then you can unfortunately not export it in an EVTX format.