Correlate recent Windows system errors by provider and event ID
Build a paste-ready command, then review its compatibility and effects before running it.
Get-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-<hours>)} | Group-Object ProviderName,Id | Sort-Object Count -Descending | Select-Object Count,@{N='ProviderAndId';E={$_.Name}},@{N='Newest';E={($_.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated}}Complete required fields to copy the generated command.
read-onlyno known side effects Compatibility
WindowsVerified for Windows using powershell syntax.
Operational knowledgereview due 2027-01-19
RequirementsGet-WinEventGet-WinEvent must be installed and available on PATH.
Version supportGet-WinEvent Current supported releasesVerified for windows using powershell syntax; consult compatibility notes for platform-specific differences.
Expected signalsCount ProviderAndId NewestRepresentative successful output; values vary with the selected target and system state.
Known errorsGet-WinEvent: command not foundGet-WinEvent is missing or is not available on PATH.
VerifyGet-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-{{hours}})} | Group-Object ProviderName,Id | Sort-Object Count -Descending | Select-Object Count,@{N='ProviderAndId';E={$_.Name}},@{N='Newest';E={($_.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated}}The output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01Get-WinEventCommandRuns the Get-WinEvent stage of this one-liner.
02-FilterHashtableOptionConfigures Get-WinEvent with the -FilterHashtable option.
03@{LogName='System'ArgumentPasses @{LogName='System' to Get-WinEvent.
04;Command separatorEnds this shell statement before the next one begins.
05Level=2Variable assignmentSets a value used by the commands that follow.
06;Command separatorEnds this shell statement before the next one begins.
07StartTime=(Get-Date).AddHours(-<hours>)}Variable assignmentSets a value used by the commands that follow.
08|PipelinePasses the output on the left to the command on the right.
09Group-ObjectCommandRuns the Group-Object stage of this one-liner.
10ProviderName,IdArgumentPasses ProviderName,Id to Group-Object.
11|PipelinePasses the output on the left to the command on the right.
12Sort-ObjectCommandRuns the Sort-Object stage of this one-liner.
13CountArgumentPasses Count to Sort-Object.
14-DescendingOptionConfigures Sort-Object with the -Descending option.
15|PipelinePasses the output on the left to the command on the right.
16Select-ObjectCommandRuns the Select-Object stage of this one-liner.
17Count,@{N='ProviderAndId'ArgumentPasses Count,@{N='ProviderAndId' to Select-Object.
18;Command separatorEnds this shell statement before the next one begins.
19E={$_.Name}},@{N='Newest'Variable assignmentSets a value used by the commands that follow.
20;Command separatorEnds this shell statement before the next one begins.
21E={($_.GroupVariable assignmentSets a value used by the commands that follow.
22|PipelinePasses the output on the left to the command on the right.
23Sort-ObjectCommandRuns the Sort-Object stage of this one-liner.
24TimeCreatedArgumentPasses TimeCreated to Sort-Object.
25-DescendingOptionConfigures Sort-Object with the -Descending option.
26|PipelinePasses the output on the left to the command on the right.
27Select-ObjectCommandRuns the Select-Object stage of this one-liner.
28-FirstOptionConfigures Select-Object with the -First option.
291).TimeCreated}}ArgumentPasses 1).TimeCreated}} to Select-Object.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
Get-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-24)} | Group-Object ProviderName,Id | Sort-Object Count -Descending | Select-Object Count,@{N='ProviderAndId';E={$_.Name}},@{N='Newest';E={($_.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated}}
Example output
Count ProviderAndId Newest
----- ------------- ------
14 Microsoft-Windows-DNS-Client, 1014 7/23/2026 9:41:08 AM
3 Disk, 153 7/23/2026 8:12:01 AM
Illustrative output — exact values vary by system and data.
Official sources