PowerShell Logo Small

Get-Event



This is the built-in help made by Microsoft for the command 'Get-Event', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.

SYNOPSIS

Gets the events in the event queue.

SYNTAX


Get-Event [[-SourceIdentifier] [<String>]] [-InformationAction {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend}] [-InformationVariable [<System.String>]]
[<CommonParameters>]
Get-Event [-EventIdentifier] <Int32> [-InformationAction {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend}] [-InformationVariable [<System.String>]]
[<CommonParameters>]



Search powershellhelp.space

DESCRIPTION


The Get-Event cmdlet gets events in the Windows PowerShell event queue for the current session. You can get all events or use the EventIdentifier or SourceIdentifier
parameters to specify the events.


When an event occurs, it is added to the event queue. The event queue includes events for which you have registered, events created by using the New-Event cmdlet, and the
event that is raised when Windows PowerShell exits. You can use Get-Event or Wait-Event to get the events.


This cmdlet does not get events from the Event Viewer logs. To get those events, use Get-WinEvent or Get-EventLog.



<

RELATED LINKS

Online Version: http://go.microsoft.com/fwlink/p/?linkid=293967
New-Event
Register-EngineEvent
Register-ObjectEvent
Register-WmiEvent
Remove-Event
Unregister-Event
Wait-Event

REMARKS

<

Examples


-------------------------- EXAMPLE 1 --------------------------

PS C:\>get-event



This command gets all events in the event queue.










-------------------------- EXAMPLE 2 --------------------------

PS C:\>get-event -sourceIdentifier "PowerShell.ProcessCreated"



This command gets events in which the value of the SourceIdentifier property is "PowerShell.ProcessCreated".










-------------------------- EXAMPLE 3 --------------------------

PS C:\>$events = get-event
PS C:\>$events[0] | format-list -property *

ComputerName :
RunspaceId : c2153740-256d-46c0-a57c-b805917d1b7b
EventIdentifier : 1
Sender : System.Management.ManagementEventWatcher
SourceEventArgs : System.Management.EventArrivedEventArgs
SourceArgs : {System.Management.ManagementEventWatcher, System.Management.EventArrivedEventArgs}
SourceIdentifier : ProcessStarted
TimeGenerated : 11/13/2008 12:09:32 PM
MessageData :

PS C:\>get-event | where {$_.TimeGenerated -ge "11/13/2008 12:15:00 PM"}

ComputerName :
RunspaceId : c2153740-256d-46c0-a57c-b8059325d1a0
EventIdentifier : 1
Sender : System.Management.ManagementEventWatcher
SourceEventArgs : System.Management.EventArrivedEventArgs
SourceArgs : {System.Management.ManagementEventWatcher, System.Management.EventArrivedEventArgs}
SourceIdentifier : ProcessStarted
TimeGenerated : 11/13/2008 12:15:00 PM
MessageData :



This example shows how to get events by using properties other than SourceIdentifier.

The first command gets all events in the event queue and saves them in the $events variable.

The second command uses array notation to get the first (0-index) event in the array in the $events variable. The command uses a pipeline operator (|) to send the event to
the Format-List command, which displays all properties of the event in a list. This allows you to examine the properties of the event object.

The third command shows how to use the Where-Object cmdlet to get an event

based on the time that it was generated.










-------------------------- EXAMPLE 4 --------------------------

PS C:\>get-event -eventIdentifier 2



This command gets the event with an event identifier of 2.