Export events from a log, log file or using structured query to a file. Usage: wevtutil { epl | export-log } PATH TARGETFILE ...

Export events from a log, log file or using structured query to a file.  Usage:  wevtutil { epl | export-log } PATH TARGETFILE    [/OPTION:VALUE [/OPTION:VALUE] ...]  PATH By default, you provide a log name for the PATH parameter. However, if you use the /lf option, then you provide the path to a log file for the PATH parameter. If you use the /sq parameter, you provide the path to a file containing a structured query.   TARGETFILE Path to the file where the exported events are to be stored.  Options:  You can use either the short (i.e. /l) or long (i.e. /locale) version of the  option names. Options and their values are case-insensitive.  /lf:VALUE (logfile) VALUE is true or false. If true, PATH is the path to a log file.  /sq:VALUE (structuredquery) VALUE is true or false. If true, PATH is the path to a file that contains a  structured query. The command may take a long time if selecting many, but not all events.  /q:VALUE (query) XPath query to specify the events that you want to export. If you do not use  this option, all events will be exported. This option is not available when /sq (structuredquery) is true. The command may take a long time if selecting many, but not all events.  /ow:VALUE (overwrite) VALUE is true or false. If true, and the destination file specified in TARGETFILE already exists, it will be overwritten without confirmation.  Example:  Export events from System log to C:\backup\system0506.evtx.  wevtutil epl System C:\backup\system0506.evtx
English
English (United States)
Deutsch (Deutschland)
German (Germany)
Español (España)
Spanish (Spain)
Français (France)
French (France)
italiano
Italian
日本語
Japanese