How to Combine All Windows Logs into One File: A Simple Guide

When diagnosing issues on Windows, you may need to analyze multiple event log files at once. Reviewing each file individually can take a lot of time. In this article, we’ll explain how to combine all Windows logs into one file to make it easier to find the information you need.

Why Is Combining Windows Logs Useful?

Each log file (.evtx) contains information about events on the system. By merging them, you can get a complete picture of system activity and more quickly identify the root cause of any instability or failures.

Steps to Combine Windows Logs into One File

Below is a helpful script that automates the process of merging all .evtx files in a folder into a single log file. This greatly simplifies diagnostics and saves time.

How to Use the Script?

1. Copy the folder with logs (C:\windows\system32\winevt\Logs).
2. Download the script from GitHub via the provided link.
3. Run the script and specify the path to the folder with evtx logs using the -FolderPath parameter to combine all logs into one file.

After the script finishes running, you’ll find a merge.evtx file in the logs folder.

Script Text for Merging Logs

Here’s the script text in case you need to save it for future use:

#Original code here : https://github.com/abhinav-eyesOnglass/evtx/tree/master 
# MergeEventsInside.ps1
#
# - v2 : Fixed Installer bug (setting wrong registry keys in v1)
#      : Add the possibility to run the script manually or just double click on it
#
# - v3 : Fixed a bug in FolderPath management to handle path with special characters such ad '[' & ']'
#        Using -LiteralPath instead of -Path and Out-File instead of Add-Content 
#

param(
    [string]$FolderPath
)

# Check if an argument is provided
# If no argument: Look for evtx files in the current folder, supposing it's been started manually 

if (!$FolderPath)
{
    $FolderPath = Split-Path ((Get-Variable MyInvocation).Value).MyCommand.Path
}

write-host $FolderPath -ForegroundColor Cyan

# Check the argument is a folder

if ((Test-Path -LiteralPath $FolderPath -PathType Container)-eq $false) {
    $wshell = New-Object -ComObject Wscript.Shell
    $wshell.Popup("This folder doesn't exist!",0,$FolderPath,0x1)
}
else
{
    $ListOfEvtxFiles = (Get-ChildItem -LiteralPath $FolderPath -File -Filter *.evtx | ? { $_.Name -ne "Merge.evtx" }).FullName
    
    # Check if the folder contains .evtx files
    
    if ($ListOfEvtxFiles.count -eq 0)
    {
        $wshell = New-Object -ComObject Wscript.Shell
        $wshell.Popup("Invalid path: Doesn't contain any evtx files!",0,$FolderPath,0x1)
    }
    else
    {

        # Informing the user

        Write-Host "Merge the event files found in the `"$FolderPath`" folder ..."

        # Generate the XML File for the merge operation

        $Filter = "*"
        $StructuredQueryFilePath = $FolderPath+"\StructuredQuery.xml"
        $StructuredQueryXMLFile = New-Item -Path $StructuredQueryFilePath -ItemType File -Force
        
        $String = "<QueryList>`n"
        $String += "  <Query Id=`"0`" Path=`"file://"+$ListOfEvtxFiles[0]+"`">`n"
        $ListOfEvtxFiles | % {
            $String += "    <Select Path=`"file://$_`">"+$Filter+"</Select>`n"
        }
        $String += "  </Query>`n"
        $String += "</QueryList>`n"

        $string | Out-File -LiteralPath $StructuredQueryXMLFile
  
        # Generate the merge operation

        wevtutil /sq epl $StructuredQueryXMLFile "$FolderPath\Merge.evtx" /ow:true

        Write-Host "All the events are merged into the $FolderPath\Merge.evtx file"

        $wshell = New-Object -ComObject Wscript.Shell
        $wshell.Popup("Done in $FolderPath\Merge.evtx",0,"Merge operation",0x1)

    }
}

Benefits of Using the Script

• Speeds up diagnostics – no need to go through each file individually.
• Ease of analysis – all events are collected in one place.