George2: Created page with "Sourced from https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text
$a = Get-Item *.evtx $output_file = [System.IO.StreamWrite..."

2020-02-21T10:57:38Z

Created page with "Sourced from https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text <br> <source lang=powershell> $a = Get-Item *.evtx $output_file = [System.IO.StreamWrite..."

New page

Sourced from https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text <br>
<source lang=powershell>
$a = Get-Item *.evtx
$output_file = [System.IO.StreamWriter] $("all.csv")
foreach($file in $a){
$events = get-winevent -path $file.FullName

foreach ($Event in $events) {
$xml = [xml]($Event.ToXml())

foreach ($s in $xml.Event.System.ChildNodes) {
$output_file.Write($s.Name + ":" + $s.InnerText + ",")
}
foreach ($d in $xml.Event.EventData.Data) {
$text = $d.InnerText
$text = if ($text) { $text.replace("`n","") } else { $text }
$output_file.Write($d.Name + ":" + $text + ",")
}
$output_file.WriteLine()
}
}

$output_file.Flush()
$output_file.Close()
</source>

Convert an .evtx file to text - Revision history

George2: Created page with "Sourced from https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text $a = Get-Item *.evtx $output_file = [System.IO.StreamWrite..."

George2: Created page with "Sourced from https://serverfault.com/questions/783708/convert-saved-evtx-files-to-text
$a = Get-Item *.evtx $output_file = [System.IO.StreamWrite..."