Share via


Event Viewer: Export all events during timeframe

Question

Monday, October 6, 2014 3:33 PM | 1 vote

I would like to export all events in Event Viewer within a certain time. However, when I choose to select all event sources and I receive the error "Event Viewer cannot open the event log or custom view.  Verify that Event Log service is running or query is too long.  The data is invalid (13)."

I can eventually view some events by unchecking a few items from event logs under Applications and Services Logs.  Therefore it seems that the UI is unable to handle the query for all logs.

Looking for an easy way to export from all logs for a specific time period.

All replies (1)

Wednesday, October 8, 2014 3:29 AM ✅Answered

Hi,

à However, when I choose to select all event sources and I receive the error "Event Viewer cannot open the event log or custom view.  Verify that Event Log service is running or query is too long.  The data is invalid (13)."

I’m a little confused with the operation that you described. Would you please let me know more details of it? Sorry for it.

By the way, for the error message, please refer to following KB and check if can help you.

Error message when you use Event Viewer to open an event log on a Windows Vista or a Windows Server 2008-based computer: "Event Viewer cannot open the event log or custom view"

Just my guess, you want to Create Custom View for all event logs and then click “Save All Events in Custom View As…” to save those all events. In the Filter tab in Create Custom View panel, if you check too much items from Event logs, it will be empty. I suggest that firstly create custom view for Windows Logs and export it. Then do same operation for other event logs (under the item number limitation). Meanwhile, please also refer to following article and check if Wevtutil command can help you.

Wevtutil

Query and Manage Event Logs with the Windows Events Command Line Utility

à Therefore it seems that the UI is unable to handle the query for all logs.

I will agree with you.

If any update, please feel free to let me know.

Hope this helps.

Best regards,

Justin Gu