How to get just description field from a wevtutil output

Question

I can fetch latest 5 events generated by MsiInstaller from Event logs with -

wevtutil qe Application /rd:true /f:text /c:5 /q:"*[System[Provider[@Name='MsiInstaller']]]"

But the output is too descriptive. Is it possible to get only the description field as the output.

add |findstr /v /b /c:" "|find /v "Event[" to your line... — Stephan
– Stephan, Commented Aug 11, 2016 at 13:35

Community · Accepted Answer · 2017-05-23 11:51:34Z

0

As suggested by Stephan it worked perfectly. Below is the final string, for anyone like me, looking for a solution.

wevtutil qe Application /rd:true /f:text /c:5 /q:"*[System[Provider[@Name='MsiInstaller']]]" |findstr /v /b /c:" "|find /v "Event["

CommunityBot

11 silver badge

answered Aug 12, 2016 at 9:22

A_N

1371 gold badge1 silver badge14 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1