Investigating Event Logs in Practice with Get-WinEvent — Filtering Speed Decides How Long the Investigation Takes (archived 2026-08-30)

Abstract

How to make Windows event log investigation efficient with PowerShell. Covers why filtering with Where-Object is slow, when to use FilterHashtable versus XPath, recipes for investigating reboots, logons and application crashes, and collecting from multiple machines. Archived version of https://comcomponent.com/en/blog/powershell-get-winevent-eventlog/, as published on 2026-08-30. The live article is maintained and may change after this date. First published 2026-07-25.