Read events from an event log, log file or using structured query. Usage: wevtutil { qe | query-events } PATH /OPTION:VALUE ...

Read events from an event log, log file or using structured query.  Usage:  wevtutil { qe | query-events } PATH [/OPTION:VALUE [/OPTION:VALUE] ...]  PATH By default, you provide a log name for the PATH parameter. However, if you use the /lf option, then you provide the path to a log file for the PATH parameter. If you use the /sq parameter, you provide the path to a file containing a structured query.   Options:  You can use either the short (i.e. /f) or long (i.e. /format) version of the option names. Options and their values are case-insensitive.  /lf:VALUE (logfile) VALUE is true or false. If true, PATH is the path to a log file.  /sq:VALUE (structuredquery) VALUE is true or false. If true, PATH is the path to a file that contains a structured query.  /q:VALUE (query) XPath query to filter events read. If not specified, all events will be returned. This option is not available when /sq (structuredquery) is true.  /bm:VALUE (bookmark) Path to a file which contains a bookmark from a previous query.  /sbm:VALUE (savebookmark) Path to a file in which to save a bookmark of this query. The file extension  should be .xml.  /rd:VALUE (reversedirection) Events read direction. VALUE is true or false. If true, the most recent events are returned first.  /f:VALUE (format) VALUE is XML (default), Text or RenderedXml. If Text is specified, prints events in an easy to read textual format, rather than in XML format. If RenderedXml, prints events in XML format with rendering information. Note that printing events in Text or RenderedXml formats is slower than printing in XML format.  /l:VALUE (locale) A locale string to print event text in a specific locale. Only available when printing events in text format using the /t option.  /c:VALUE (count) Maximum number of events to read.  /e:VALUE (element) When outputting event XML, include a root element to produce well-formed XML. VALUE is the string you want within the root element. For example, specifying /e:root would result in output XML with the root element pair .   Example:  Display the three most recent events from the Application log in textual format.  wevtutil qe Application /c:3 /rd:true /f:text