title: How to find specific event ID in archivedlog
body: <p>Hope you all are doing fine.
  I have a question, i want to find a specific event id in a log that is archived but there are so many of them that i want go through each one of them</p>
  <p>I have found a site on how you can do that <a href="http://blog.microsoftme.com/2014/05/09/powershell-parsing-of-archived-event-logs/" rel="nofollow noreferrer">http://blog.microsoftme.com/2014/05/09/powershell-parsing-of-archived-event-logs/</a>  but the output i get is &quot;Parsing C:\logs.evtx&quot;</p>
  <p>This is the code :</p>
  <pre><code>`Get-ChildItem -include *Sec*.evtx -Path x:\loggingarchive\ -recurse |
  
  ForEach-Object {“Parsing $($_.fullname)`r`n”
  
  
  
  Try {
  
  $TotalSearch+=Get-WinEvent -FilterHashtable @{
  
  Path=$_.fullname
  Id=4738;
  StartTime= 10/11/2020
  EndTime= 4/10/2022
  } -EA Stop
  
  $TotalSearch+=Get-WinEvent -FilterHashtable @{
  
  Path=$_.fullname
  Id=5139;
  StartTime= 10/11/2020
  
  EndTime=4/10/2021
  } -EA Stop
  
  } Catch [System.Exception] {“Done”}} &gt; C:\Users\user\Documents\logs.txt`
  </code></pre>
  <p>What am i doing wrong here,
  Instead of getting the events i get the output as noted above</p>