Wevtutil\Event Viewer: Getting list of events with different event ids using XPath Filter

3.1k Views Asked by At

I need to get a list of events that have id of 6005 or 6006 using "wevtutil" tool. This command works fine:

wevtutil qe system /rd:true /q:*[System[EventID=6005]]

But I need to get both events with ID 6005 and 6006. I tried

wevtutil qe system /rd:true /q:*[System[EventID=6005 or EventID=6006]]

But it returns

Too many arguments are specified. The parameter is incorrect.

How should I fix it?

Note: each event has the following XML structure

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='EventLog'/><EventID Qualifiers='32768'>6005</EventID><Level>4</Level><Task>0</Task><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2018-01-24T18:24:41.592259500Z'/><EventRecordID>350</EventRecordID><Channel>System</Channel><Computer>LAPTOP-IN03NS68</Computer><Security/></System><EventData><Binary>E20701000300180012001800290050020000000000000000</Binary></EventData></Event>
2

There are 2 best solutions below

1
On

"/q:*[System[(EventID=6005) or (EventID=6006)]]"

0
On

eryksun already answered in command. double quotes must be used