> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Collect Windows Event Logs

> Collect windows event logs based on their event names, and write them into a .csv file on a remote machine using the WinRM protocol.

For more information, visit the [Microsoft Documentation](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3).

If a host name is not provided in the connection, the host must be provided in the `Host` parameter.

## Parameters[​](#parameters "Direct link to Parameters")

| Parameter              | Description                                                                                                                                                                                                                                                                                                                                                                                                      |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Log Name               | The name of the event log.                                                                                                                                                                                                                                                                                                                                                                                       |
| Max Events             | The number of event log entries to retrieve, Retrieves the most recent log as default.                                                                                                                                                                                                                                                                                                                           |
| Log Output Destination | The absolute path of the logs output file, including the full filename.                                                                                                                                                                                                                                                                                                                                          |
| Destination Path       | The absolute path of the archived file, including the file name.                                                                                                                                                                                                                                                                                                                                                 |
| Host                   | Which host to connect to if one is not specified in the connection. Can be an IP or a fully qualified domain name. When using an HTTPS endpoint (encrypted communications), make sure to use the specified format: `https://<your-ip-or-domain>:<port-number>/wsman`. For example: `https://windows-host:5986/wsman`. If the provided connection has a host specified, using this parameter results in an error. |