Sample Header Ad - 728x90

How to get the last event id for each day & level of windows event viewer?

0 votes
0 answers
19 views
I've built a MySQL database from a Windows Event Viewer, trying to track down the last event for each possible level of event. For example, the last event for level Warning on 8/2/2025 might be 10016 (Distributed COM). (The database was populated by a powershell script, courtesy Google's AI.:
# Define the log name (e.g., 'System', 'Application', 'Security')
$LogName = 'System' 

# Define the path for the output CSV file
$OutputPath = "EventLog_24hr_Format.csv"

# Get events from the specified log and select/format properties
Get-WinEvent -LogName $LogName | Select-Object -Property @{Name='TimeCreated';Expression={$_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')}},
    LevelDisplayName,
    Id,
    TaskDisplayName,
    ProviderName | 
    Export-Csv -Path $OutputPath -NoTypeInformation
) Here's what I know does NOT work: select datestamp, leveldisplayname, max(timecreated), id from all_events group by datestamp, leveldisplayname LIMIT 0, 10 because Error Code: 1055. Expression #4 of SELECT list is not in GROUP BY clause and contains nonaggregated column 'events.all_events.Id' which is not functionally dependent on columns in GROUP BY clause; this is incompatible with sql_mode=only_full_group_by So, how do I get the last event id for each day, level combination?
Asked by geoB (147 rep)
Aug 3, 2025, 10:27 PM