A client sent me some .evtx event log export files. I'm looking for a free viewer with filter/query capabilities.

  • I have looked at NirSoft's MyEventViewer with its /LoadFiles option, but from the documentation it's unclear whether that loads the files into the log files, which I definitely don't want (the comment that I have to specify the appropriate log type name makes me suspicious). It also talks only about .evt files, not .evtx. If anyone can confirm that it does not load the files into the system logs, I can investigate it further. (I have sent them a mail, but no response yet see accepted answer).

  • Windows Event Viewer Plus cannot load files

  • EvtLogParser comes close. It is handy for querying, but has no 'view all' mode where you can just browse through the file unfiltered. At a minimum I have to select the event type (error, warning, information...) so it is workable, but maybe there's something better.

  • Event Log Explorer has everything I like, but it only has a free version for personal use

  • MS Log Parser is a command-line tool ;-)


In response to my query Nirsoft updated their MyEventViewer (which only reads the old style .evt levent log files) and published FullEventLogView v1.00.

FullEventLogView is a simple tool for Windows 10/8/7/Vista that displays in a table the details of all events from the event logs of Windows, including the event description. It allows you to view the events of your local computer, events of a remote computer on your network, and events stored in .evtx files. It also allows you to export the events list to text/csv/tab-delimited/html/xml file from the GUI and from command-line.

Selecting the source:

enter image description here

Filtering is then done in the Advanced Options:

enter image description here


In addition to my other answer, I found out by accident:

You can just double click a .evtx file and it will open in the Windows Event Log Viewer in a separate Saved logs folder:

enter image description here

So there is no danger of overwriting or merging with your own event logs (that's what prompted me to write the question).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy