GIST – Filter Windows Eventlog Messages By Log, Event ID, and Message
$startDate = (Get-Date -Year 2023 -Month 8 -Day 1).Date # .Date makes it midnight $endDate = (Get-Date -Year 2023 -Month 8 -Day 20).Date
Get-WinEvent -FilterHashtable @{logname = 'Application'; id = 4} -MaxEvents 25 | Where-Object { $_.Timecreated -ge $startDate -and $_.Timecreated -lt $endDate } | where message -match "Message to find" | Format-Table -wrap
GIST – Using HashIDs
Add-Type -Path "C:\Temp\Hashids.net.1.0.0\lib\net40\Hashids.net.dll"
$orgids = New-Object HashidsNet.Hashids("orgkey",3, "abcdefghjkmnpqrstuvwxyz23456789")
$userids = New-Object HashidsNet.Hashids("accountkey",6, "abcdefghjkmnpqrstuvwxyz23456789")
$orgids.Encode(1); $userids.Encode(1);
GIST – Find Windows Eventlog Shutdown Events
Get-WinEvent -FilterHashtable @{logname = 'System'; id = 1074, 6005, 6006, 6008} -MaxEvents 6 | Format-Table -wrap
GIST – Notepad++
Search for text ‘term’ unless it is followed by a tab character.
term(?!\t)
GIST – GREP
# Search recursive case insensitive and show line before and after grep -iR -B 1 -A 1 "searchterm" ./ # Search recursive case insensitive but show file name instead of matching line grep -liR "searchterm" ./