How to get the last event id for each day & level of windows event viewer?
0
votes
0
answers
19
views
I've built a MySQL database from a Windows Event Viewer, trying to track down the last event for each possible level of event. For example, the last event for level Warning on 8/2/2025 might be 10016 (Distributed COM).
(The database was populated by a powershell script, courtesy Google's AI.:
# Define the log name (e.g., 'System', 'Application', 'Security')
$LogName = 'System'
# Define the path for the output CSV file
$OutputPath = "EventLog_24hr_Format.csv"
# Get events from the specified log and select/format properties
Get-WinEvent -LogName $LogName | Select-Object -Property @{Name='TimeCreated';Expression={$_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')}},
LevelDisplayName,
Id,
TaskDisplayName,
ProviderName |
Export-Csv -Path $OutputPath -NoTypeInformation
)
Here's what I know does NOT work:
select datestamp, leveldisplayname, max(timecreated), id from all_events group by datestamp, leveldisplayname LIMIT 0, 10
because Error Code: 1055. Expression #4 of SELECT list is not in GROUP BY clause and contains nonaggregated column 'events.all_events.Id' which is not functionally dependent on columns in GROUP BY clause; this is incompatible with sql_mode=only_full_group_by
So, how do I get the last event id for each day, level combination?
Asked by geoB
(147 rep)
Aug 3, 2025, 10:27 PM