@echo off
REM Only show event logs from a point in time on
set buildDate=%DATE:~4,10%
set dateStr=%buildDate:~6,4%-%buildDate:~0,2%-%buildDate:~3,2%
set timeStr=%TIME:~0,8%
REM wevtutil qe System "/q:*[System[TimeCreated[@SystemTime>='2016-04-20T00:00:00']]]"
REM wevtutil qe System "/q:*[System[TimeCreated[@SystemTime>='%dateStr%T00:00:00']]]"
REM .
REM .
REM .
REM This shows All Application Events that are today, since midnight
REM ** Outputs as text (/f:text)
REM ** Connects to a remote server (/r:remotemachine)
C:\Windows\System32\wevtutil.exe qe Application "/q:*[System[TimeCreated[@SystemTime>='%dateStr%T00:00:00']]]" /f:text /r:remotemachine > %cTMP%
REM .
REM .
REM .
REM .