Tool to view .evtx Windows event log files

Question

A client sent me some .evtx event log export files. I'm looking for a free viewer with filter/query capabilities.

• I have looked at NirSoft's MyEventViewer with its /LoadFiles option, but from the documentation it's unclear whether that loads the files into the log files, which I definitely don't want (the comment that I have to specify the appropriate log type name makes me suspicious). It also talks only about .evt files, not .evtx. If anyone can confirm that it does not load the files into the system logs, I can investigate it further. (I have sent them a mail, but no response yet see accepted answer).

• Windows Event Viewer Plus cannot load files

• EvtLogParser comes close. It is handy for querying, but has no 'view all' mode where you can just browse through the file unfiltered. At a minimum I have to select the event type (error, warning, information...) so it is workable, but maybe there's something better.

• Event Log Explorer has everything I like, but it only has a free version for personal use

• MS Log Parser is a command-line tool ;-)

Answer 1

In addition to my other answer, I found out by accident:

You can just double click a .evtx file and it will open in the Windows Event Log Viewer in a separate Saved logs folder:

So there is no danger of overwriting or merging with your own event logs (that's what prompted me to write the question).

Answer 2

In response to my query Nirsoft updated their MyEventViewer (which only reads the old style .evt levent log files) and published FullEventLogView v1.00.

FullEventLogView is a simple tool for Windows 10/8/7/Vista that displays in a table the details of all events from the event logs of Windows, including the event description. It allows you to view the events of your local computer, events of a remote computer on your network, and events stored in .evtx files. It also allows you to export the events list to text/csv/tab-delimited/html/xml file from the GUI and from command-line.

Selecting the source:

Filtering is then done in the Advanced Options:

Answer 3

Gigasheet is a free, online cybersecurity data analysis tool. You can open EVTX files in a spreadsheet-like interface that supports searching, filtering, and segmenting large EVTX files. You can upload files up to 10GB for free and export files as a CSV. Full disclosure: I'm co-founder at Gigasheet.

More details about the EVTX viewer here: https://www.gigasheet.co/post/online-evtx-parser-and-viewer