In Part III of my Diagnostic Logging series, we’ll have a look at the PowerShell command, Get-SPLogEvent.
No matter what you want to do with your trace logs, there’s a script for it. Well, you may have to write it, but there is one! Here are some examples you can copy and paste to get you started. Once you get the hang of it, it’s really easy to figure out.
### Get all events within the last 10 minutes
get-SPLogEvent -StartTime (get-date).AddMinutes(-10)
### Get all HIGH level events of the last 10 minutes
get-SPLogEvent -StartTime (get-date).AddMinutes(-10) | ?{$_.level -eq “high”}
### Get all High level events, selecting just the first 25 items and their
### correlation id and category, and sorting it by category
get-SPLogEvent -StartTime (get-date).AddMinutes(-10) | ?{$_.level -eq “high”} | select correlation, category -first 25 | sort category
### Want to see what’s up with your timer jobs in the last half hour
get-SPLogEvent -StartTime (get-date).AddMinutes(-30) -minimumlevel “Medium” | ?{$_.Category -eq “Timer”}
Here are some screen grabs so you can see a little of what the output is like.
#1. Get the log entries from the past minute that are High level. The | means pipe, or “send the output to.” In this case, we’re sending the output to a Where-Object clause ( that’s the ? ). This takes each result and filters it in or out of the result set.

2. Same thing as #1, only use 10 minutes, then sort the output. The | means pipe, or “send the output to.” In this case, we’re sending output to another powershell command, called sort.
3. Here is the same command from #2, but we now have a select clause. Just like in SQL, this clause isspecifying what fields to display.

4. This is the same as #3, except we’re also specifying that we want only the first 25 results. Then, we’re taking one of the correlation tokens and specifying results that contain that exact correlation token.
Hopefully this is enough to get the exact result sets you’re looking for. If not, leave me a comment and I’ll try to get you the script you need.


























And while I appreciate the blogs out there that teach Admins how to code, let’s face it, even developers don’t instanciate objects when they don’t need them. So, here’s the long way that some suggest: 















