private void BtnSearch_Click(object sender, EventArgs e) { lblErrPath.Text = ""; if (string.IsNullOrWhiteSpace(txtBoxEventID.ToString())) { lblResults.Text = "EventID can not be blank"; return; } if (!File.Exists(TxtBoxEvtFpath.Text) && !Directory.Exists(TxtBoxEvtFpath.Text)) { lblResults.Text = "Input event log file or folder does not exist: "; lblErrPath.Text = TxtBoxEvtFpath.Text; return; } if (!Directory.Exists(Path.GetDirectoryName(TxtBoxOutput.Text))) { lblResults.Text = "Output directory does not exist: " + Path.GetDirectoryName(TxtBoxOutput.Text); lblErrPath.Text = TxtBoxOutput.Text; return; } int recordCount = 0; string searchString = "*"; string directorypath = TxtBoxEvtFpath.Text; string writeOutputpath = TxtBoxOutput.Text; string filterText = txtboxFilter.Text; bool boolGroupProperties = false; if (chkGroupProperties.Checked == true) { boolGroupProperties = true; } //set filters for query if (txtBoxEventID.Text != "" && txtBoxEventID.Text != "*") { searchString = "*[System[(EventID=" + txtBoxEventID.Text + ")"; } if (txtBoxTimeDiff.Text != "") { long timeFilter = 0; string timeDiff = txtBoxTimeDiff.Text; bool canConvert = long.TryParse(timeDiff, out timeFilter); if (canConvert == true) { if (searchString.Contains("*[System[")) { searchString = searchString + " and TimeCreated[timediff(@SystemTime) <= " + timeFilter.ToString() + "]"; } else if (searchString.Contains("*") || searchString == "") { searchString = "*[System[TimeCreated[timediff(@SystemTime) <= " + timeFilter.ToString() + "]"; } } } if (searchString.Contains("*[System[")) { searchString = searchString + "]]"; } if (radioFileFolder1.Checked == true) { //List<EventRecord> foundRecords = EventLogHelper.SearchEventLogs(TxtBoxEvtFpath.Text, searchString); //recordCount = EventLogHelper.WriteEventRecords(foundRecords, writeOutputpath, filterText, true, boolGroupProperties); recordCount = EventLogHelper.SearchEventLog(TxtBoxEvtFpath.Text, searchString, writeOutputpath, filterText, boolGroupProperties); lblResults.Text = $"{recordCount} results were returned"; } else { int recordsCount = 0; string[] fileEntries = Directory.GetFiles(directorypath); foreach (string fileName in fileEntries) { //List<EventRecord> foundRecords = EventLogHelper.SearchEventLogs(fileName, searchString); //recordCount = EventLogHelper.WriteEventRecords(foundRecords, writeOutputpath, filterText, true, boolGroupProperties); recordCount = EventLogHelper.SearchEventLog(fileName, searchString, writeOutputpath, filterText, boolGroupProperties); recordsCount = recordsCount + recordCount; } lblResults.Text = $"{recordsCount} results were returned"; } }