This pattern is useful when a known troubleshooting query should run against more than one machine.

It comes from the source example at Modules/PSEventViewer/Examples/Example.QueryNamedEventsSMB01.ps1.

When to use this pattern

• You have a named event query already defined by the module.
• You need to query more than one machine.
• You want a short time window instead of scanning the full log.

Example

Import-Module PSEventViewer

$findWinEventSplat = @{
    Type        = 'ADSMBServerAuditV1'
    MachineName = 'Server01', 'Server02'
    Verbose     = $true
}

Find-WinEvent @findWinEventSplat -TimePeriod Last3Days | Format-Table *

What this demonstrates

• using a named event query type
• targeting multiple machines
• limiting the query to a recent time period

Source

• Example.QueryNamedEventsSMB01.ps1