
close
close
Chance to win $250 in Petri 2023 Audience Survey
If you have used the PowerShell Get-Eventlog cmdlet to display event logs, then you have probably been a little frustrated. You’ll run a command like this:
get-eventlog system -newest 10 -EntryType Error
But the default display is hardly helpful.
PowerShell’s get-eventlog default display. (Image Credit: Jeff Hicks)
Formatting the get-eventlog display as a list. (Image Credit: Jeff Hicks)
Grabbing an object and piping it to get-member in Windows PowerShell. (Image Credit: Jeff Hicks)
Viewing the XML file in the PowerShell ISE. (Image Credit: Jeff Hicks)
As you can see there are a few FormatViewDefinition settings.You can drill down to see the details.FormatViewDefinition settings. (Image Credit: Jeff Hicks)
This should be the same type of information you saw in the dottypes format file. In order to change the format data for this type, I am going to have to create my own .ps1xml file. In that file, I can make sure the List control comes first. To extract the data I want, PowerShell will let me export to a new file.FormatViewDefinition settings. (Image Credit: Jeff Hicks)
Get-FormatData -TypeName System.Diagnostics.EventLogEntry | Export-FormatData -Path $newFile -IncludeScriptBlock –Force
The new file is an XML document, so I can manipulate it from PowerShell.
I can easily navigate the document.What I need to do is move the view nodes around, so let's get them using an XPath filter.Navigating to the document in Windows PowerShell. (Image Credit: Jeff Hicks)
The second node is my list control, which I want to move before the table. However, the XML document doesn't have a move method from what I can tell. Because of this, I will have to work around this limitation by copying the second view.Selecting nodes with the xPath filter. (Image Credit: Jeff Hicks)
Now I can insert this copy before the table control view, which I can do from the parent node.
$tmp.Configuration.ViewDefinitions.InsertBefore($clone,$views[0])
Now there are three entries.
Our three entries. (Image Credit: Jeff Hicks)
$tmp.Configuration.ViewDefinitions.RemoveChild($views[1])
Now I have what I want.
We now have two entries. (Image Credit: Jeff Hicks)
You only need to go through this process once to create your own .ps1xml file. Now , let's use it. Right now I still have the default output:To change this, I will use Update-FormatData and specify my new .ps1xml file. If you look at the cmdlet help, you will see there are parameters for prepending and appending. In this case, I want my file to overwrite the Microsoft version, so I will prepend.The default output for get-eventlog. (Image Credit: Jeff Hicks)
Now look at the result:PowerShell automatically formatted the result as a list. If I want a table, I can still ask for it.PowerShell automatically formatted the result as a list. (Image Credit: Jeff Hicks)
This change will only last for as long as my PowerShell session is running. Don't like a change or made a mistake? Exit and restart PowerShell to return to the default settings. However, if this is something I know I always want, then I will add this line to my PowerShell profile script.
If Microsoft changes the default view in a future version of Windows, which I hope they do, all I have to do is remove the line from my profile. In the meantime, if you would prefer a list by default, you should be able to follow these steps.
More in PowerShell
Most popular on petri