@@ -151,9 +151,9 @@ with the asterisk (`*`) wildcard to display each property.
151151
152152### Example 3: Configure the classic Security log
153153
154- This command gets an ** EventLogConfiguration** object that represents the classic ** Security** log. The
155- object is then used to configure settings for the log, such as max file size, file path, and whether the
156- log is enabled.
154+ This command gets an ** EventLogConfiguration** object that represents the classic ** Security** log.
155+ The object is then used to configure settings for the log, such as max file size, file path, and
156+ whether the log is enabled.
157157
158158``` powershell
159159$log = Get-WinEvent -ListLog Security
@@ -196,17 +196,18 @@ ProviderLatency : 1000
196196ProviderControlGuid :
197197```
198198
199- The ` Get-WinEvent ` cmdlet uses the ** ListLog** parameter to specify the ** Security** log. The object is
200- saved to a variable. The ** MaximumSizeInBytes** property is set to 1 gigabyte on the object. The
199+ The ` Get-WinEvent ` cmdlet uses the ** ListLog** parameter to specify the ** Security** log. The object
200+ is saved to a variable. The ** MaximumSizeInBytes** property is set to 1 gigabyte on the object. The
201201** SaveChanges** method is called to push the change to the system inside of a try block to handle
202- access violations. The ` Get-WinEvent ` cmdlet is called again on the ** Security** log and piped to the
203- ` Format-List ` cmdlet to verify that the ** MaximumSizeInBytes** property has been saved on the machine.
202+ access violations. The ` Get-WinEvent ` cmdlet is called again on the ** Security** log and piped to
203+ the ` Format-List ` cmdlet to verify that the ** MaximumSizeInBytes** property has been saved on the
204+ machine.
204205
205206### Example 4: Get event logs from a server
206207
207208This command only gets event logs on the local computer that contain events. It's possible for a
208209log's ** RecordCount** to be null or zero. The example uses the ` $_ ` variable. For more information,
209- see [ about_Automatic_Variables] ( ../Microsoft.PowerShell.Core/about/about_automatic_variables .md ) .
210+ see [ about_Automatic_Variables] ( ../Microsoft.PowerShell.Core/About/about_Automatic_Variables .md ) .
210211
211212``` powershell
212213Get-WinEvent -ListLog * -ComputerName localhost | Where-Object { $_.RecordCount }
@@ -233,7 +234,8 @@ is a property of the object with a non-null value.
233234
234235This example gets objects that represent the ** Application** event logs on three computers:
235236Server01, Server02, and Server03. The ** ForEach** keyword is used because the ** ComputerName**
236- parameter accepts only one value. For more information, see [ about_Foreach] ( ../Microsoft.PowerShell.Core/about/about_Foreach.md ) .
237+ parameter accepts only one value. For more information, see
238+ [ about_Foreach] ( ../Microsoft.PowerShell.Core/About/about_Foreach.md ) .
237239
238240``` powershell
239241$S = 'Server01', 'Server02', 'Server03'
@@ -345,7 +347,8 @@ This command lists the Event Ids that the **Microsoft-Windows-GroupPolicy** even
345347along with the event description.
346348
347349``` powershell
348- (Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description
350+ (Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events |
351+ Format-Table Id, Description
349352```
350353
351354``` Output
@@ -505,7 +508,7 @@ is required.
505508
506509``` powershell
507510Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -Oldest |
508- Sort-Object -Property TimeCreated -Descending |
511+ Sort-Object -Property TimeCreated -Descending |
509512 Select-Object -First 100
510513```
511514
@@ -526,7 +529,7 @@ reading from an `.etl` file, but the **Oldest** parameter applies to each file.
526529
527530``` powershell
528531Get-WinEvent -Path 'C:\Tracing\TraceLog.etl', 'C:\Test\Windows PowerShell.evtx' -Oldest |
529- Where-Object { $_.Id -eq '403' }
532+ Where-Object { $_.Id -eq '403' }
530533```
531534
532535The ` Get-WinEvent ` cmdlet gets log information from the archived files. The ** Path** parameter uses
@@ -573,8 +576,9 @@ Get-WinEvent -LogName 'Windows PowerShell' -FilterXPath $XPath
573576
574577This example uses the ** FilterHashtable** parameter to get events from the ** Application** log. The
575578hash table uses ** key/value** pairs. For more information about the ** FilterHashtable** parameter,
576- see [ Creating Get-WinEvent queries with FilterHashtable] ( /powershell/scripting/samples/Creating-Get-WinEvent-queries-with-FilterHashtable ) .
577- For more information about hash tables, see [ about_Hash_Tables] ( ../Microsoft.PowerShell.Core/about/about_hash_tables.md ) .
579+ see [ Creating Get-WinEvent queries with FilterHashtable] ( /powershell/scripting/samples/creating-get-winevent-queries-with-filterhashtable ) .
580+ For more information about hash tables, see
581+ [ about_Hash_Tables] ( ../Microsoft.PowerShell.Core/About/about_Hash_Tables.md ) .
578582
579583``` powershell
580584$Date = (Get-Date).AddDays(-2)
@@ -739,8 +743,9 @@ Help.
739743
740744Use an XML query to create a complex query that contains several XPath statements. The XML format
741745also allows you to use a **Suppress XML** element that excludes events from the query. For more
742- information about the XML schema for event log queries, see [Query Schema](/windows/win32/wes/queryschema-schema)
743- and the XML Event Queries section of [Event Selection](/previous-versions/aa385231(v=vs.85)).
746+ information about the XML schema for event log queries, see
747+ [Query Schema](/windows/win32/wes/queryschema-schema) and the XML Event Queries section of
748+ [Event Selection](/previous-versions/aa385231(v=vs.85)).
744749
745750You may also create a **Suppress** element using the **FilterHashtable** parameter.
746751
@@ -760,7 +765,8 @@ Accept wildcard characters: False
760765
761766Specifies an XPath query that this cmdlet select events from one or more logs.
762767
763- For more information about the XPath language, see [XPath Reference](/previous-versions/dotnet/netframework-4.0/ms256115(v=vs.100))
768+ For more information about the XPath language, see
769+ [XPath Reference](/previous-versions/dotnet/netframework-4.0/ms256115(v=vs.100))
764770and the Selection Filters section of [Event Selection](/previous-versions/aa385231(v=vs.85)).
765771
766772` ` ` yaml
@@ -841,8 +847,8 @@ cmdlet.
841847> [!NOTE]
842848> PowerShell does not limit the amount of logs you can request. However, the `Get-WinEvent` cmdlet
843849> queries the Windows API which has a limit of 256. This can make it difficult to filter through all
844- > of your logs at one time. You can work around this by using a `foreach` loop to iterate through each
845- > log like this: `Get-WinEvent -ListLog * | ForEach-Object{ Get-WinEvent -LogName $_.LogName }`
850+ > of your logs at one time. You can work around this by using a `foreach` loop to iterate through
851+ > each log like this: `Get-WinEvent -ListLog * | ForEach-Object{ Get-WinEvent -LogName $_.LogName }`
846852
847853` ` ` yaml
848854Type: System.String[]
@@ -939,7 +945,8 @@ Accept wildcard characters: True
939945
940946This cmdlet supports the common parameters : -Debug, -ErrorAction, -ErrorVariable,
941947-InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose,
942- -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
948+ -WarningAction, and -WarningVariable. For more information, see
949+ [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
943950
944951# # INPUTS
945952
@@ -980,13 +987,13 @@ Environment (Windows PE).
980987
981988# # RELATED LINKS
982989
983- [about_Automatic_Variables](../Microsoft.PowerShell.Core/about/about_automatic_variables .md)
990+ [about_Automatic_Variables](../Microsoft.PowerShell.Core/About/about_Automatic_Variables .md)
984991
985- [about_Foreach](../Microsoft.PowerShell.Core/about /about_Foreach.md)
992+ [about_Foreach](../Microsoft.PowerShell.Core/About /about_Foreach.md)
986993
987- [about_Hash_Tables](../Microsoft.PowerShell.Core/about/about_hash_tables .md)
994+ [about_Hash_Tables](../Microsoft.PowerShell.Core/About/about_Hash_Tables .md)
988995
989- [Creating Get-WinEvent queries with FilterHashtable](/powershell/scripting/samples/Creating-Get-WinEvent -queries-with-FilterHashtable )
996+ [Creating Get-WinEvent queries with FilterHashtable](/powershell/scripting/samples/creating-get-winevent -queries-with-filterhashtable )
990997
991998[Format-Table](../Microsoft.PowerShell.Utility/Format-Table.md)
992999
0 commit comments