How to export Windows events of remote computer to csv file from command line

FullEventLogView is a simple tool for Windows that allows you to view and export the events from the event log of Windows. You can extract the events from your local machine, remote computer, and external .evtx files.
In order to export Windows events from a remote computer on your network, you must have Administrator access to the remote machine. If you don't know how to configure the remote machine correctly, the following Blog post may help you: How to connect a remote Windows 7/Vista/XP computer with NirSoft utilities

Here's some command-line examples to show you how to export Windows events of remote computer on your network to csv file (Comma-Delimited file), using the FullEventLogView tool:

  • Export all events of remote computer MyComputer5 to myevents.csv . The '/DataSource 2' requests to load events from remote computer, and '/TimeFilter 0' means without time filter.
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /TimeFilter 0 /DataSource 2 /ComputerName MyComputer5
  • If there are a lot of events, it's recommended to use the /SaveDirect command, so the events will be saved directly to the file without loading them into the memory first:
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /TimeFilter 0 /DataSource 2 /ComputerName MyComputer5 /SaveDirect
  • Export all events of remote computer 192.168.0.25 from the last 5 days ('/TimeFilter 1' means to filter the events to the last xx days/hours/minutes. '/LastTimeFilterUnit 4' - Use days unit)
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.25 /TimeFilter 1 /LastTimeFilterUnit 4 /LastTimeFilterValue 5
  • Export all events of remote computer 192.168.0.25 from the last 10 hours ('/TimeFilter 1' means to filter the events to the last xx days/hours/minutes. '/LastTimeFilterUnit 3' - Use hours unit)
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.25 /TimeFilter 1 /LastTimeFilterUnit 3 /LastTimeFilterValue 10
  • Export all events of remote computer 192.168.0.25 from the last 20 minutes ('/TimeFilter 1' means to filter the events to the last xx days/hours/minutes. '/LastTimeFilterUnit 2' - Use minutes unit)
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.25 /TimeFilter 1 /LastTimeFilterUnit 2 /LastTimeFilterValue 20
  • Export only events with the specified Event ID (41, 42, 1, 1074, 6005, 6006). '/EventIDFilter 2' means to load only events with the Event IDs specified in /EventIDFilterStr
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.30 /TimeFilter 0 /EventIDFilter 2 /EventIDFilterStr "41, 42, 1, 1074, 6005, 6006"
  • Export only events of the specified event channel (Microsoft-Windows-WLAN-AutoConfig/Operational)
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.35 /TimeFilter 0 /ChannelFilter 2 /ChannelFilterStr "Microsoft-Windows-WLAN-AutoConfig/Operational"
  • Export to csv file only error and critical events of the remote computer 192.168.0.15
    FullEventLogView.exe /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.15 /TimeFilter 0 /ShowWarning 0 /ShowInformation 0 /ShowUndefined 0 /ShowVerbose 0 /ShowError 1 /ShowCritical 1
  • Export all system events of the remote computer and sort the events list by Event ID and then by Event Time (Secondary sort). Be aware that the /sort command doesn't work when /SaveDirect command is used.
    FullEventLogView.exe /Sort "Event ID" /Sort "Event Time" /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.11 /TimeFilter 0 /ChannelFilter 2 /ChannelFilterStr "System"
  • Instead of specifying all event filters in the command-line, you can simply load all settings from .cfg file, for example:
    FullEventLogView.exe /cfg "c:\temp\myconfig/cfg" /scomma "c:\temp\myevents.csv" /DataSource 2 /ComputerName 192.168.0.22

You can open the .csv files created by the FullEventLogView tool in Excel. Be aware that the FullEventLogView tool works on Windows Vista or later, including Windows 10. Windows XP is not supported.