Tau EventID Filter error about chainsaw HOT 6 CLOSED

Yep, im using Powershell.
After following your last recommendation of changing ' for " it works!

Thanks a lot!

from chainsaw.

Hey @Richard1611,

The Key/Value pair is delimited with : (#114). So it would be Event.System.EventID: 4104

from chainsaw.

Hi Alex, Thanks for your repply.

Now, when am doing chainsaw.exe search c:\Windows\System32\winevt\Logs -t Event.System.EventID: 4104 im getting this error:

[x] Specified event log path is invalid - 4104

I've tried to change the parameters orders as the help says, but it still not working.

Example:
chainsaw.exe search [OPTIONS] [PATTERN] [PATH] = chainsaw.exe search -t Event.System.EventID: 4624 c:\Windows\System32\winevt\Logs

from chainsaw.

Because there is a space there you will need to wrap it in quotes, something like this:
chainsaw.exe search c:\Windows\System32\winevt\Logs -t 'Event.System.EventID: 4104'

Also as EventID can sometimes be a string, IIRC, the safest way to do it is:
chainsaw.exe search c:\Windows\System32\winevt\Logs -t 'int(Event.System.EventID): 4104'

from chainsaw.

It stills giving me the same error:
[x] Specified event log path is invalid - 4104'

PD: Chainsaw version 2.6.0

from chainsaw.

Oh is this in Command Prompt or Powershell, you probably need to use " instead if '. I don't use Windows all that much.

from chainsaw.