Wevtutil to output event log description

Question

Is there anyway to only output the description field in an event log entry?

Im current using:

wevtutil qe Application /q:*[System[(EventID=431)]] /f:text /rd:true /c:2 /gm:true > C  :\query.txt

However this output everything. I just want to output the description which is under:

<EventData> 
<Data> Description bllah blah</data> 
</EventData>

Solution

You can use /f:text modifier and grep with ^|FIND "Description"

wevtutil qe Application /q:*[System[(EventID=431)]] /f:text /rd:true /c:2 /gm:true ^|FIND "Description" > C:\query.txt

Note the ^ before the pipe, it escapes the pipe in scripts.

Comments

[Shannon]

/gm:true doesn't appear to be a valid argument, and when I remove it all I get are single lines containing " Description:"

[Shannon]

I don't think /gm:true available for the "qe" command. I think the key is to not use "/f:text". In XML format, it will give you the /Event/EventData/Data element.