Find event ID on clients

Question

Is there any possible we can get a specific event ID from all clients?

It's better to get the count of the event ID appeared on each clients.

Anyone tried this?

Answer 1

Hi, @StiFenclii-5690

Thank you for posting in Microsoft Q&A forum.

If you are using SCCM, I think CMPivot is the most suitable function to get the info:

For example, find out the event ID 7040:

EventLog('System') | summarize countif( (EventID == 7040) ) by Device | where (countif_ > 0)

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.