How do I convert EVTX to CSV with PowerShell?

On Windows: Get-WinEvent -Path .\Security.evtx | Select-Object TimeCreated, Id, ProviderName, Message | Export-Csv events.csv -NoTypeInformation. It needs a Windows host and puts all event fields into the single Message column; the in-browser converter splits EventData into separate columns and runs on any OS.

Can Event Viewer save an EVTX file as CSV?

Yes: open the log, choose Save All Events As… and pick CSV (Comma Separated). The output keeps only the summary columns plus the rendered message text, so you lose the structured EventData fields.

How do I convert EVTX to CSV on Linux or macOS?

Use this browser-based converter, or a command-line tool such as EvtxECmd (--csv) or evtx_dump piped through a JSON-to-CSV step. All of them parse the binary format directly, without Windows.

Is my EVTX file uploaded during conversion?

No. The file is read into your browser's memory and converted there. You can disconnect from the network after the page loads and the conversion still works.

Convert EVTX to CSV

Turn a Windows .evtx event log into a CSV you can open in Excel, LibreOffice or pandas — directly in your browser. The file is parsed locally by a Rust parser compiled to WebAssembly, so nothing is uploaded and no Windows host is needed.

Open the EVTX to CSV converter ↗

What the CSV contains

One row per event

Every record becomes a row with the common columns: record number, timestamp (UTC), level, Event ID, provider, channel and computer. When you load several .evtx files at once, a Source column tells you which file each row came from.

EventData as real columns

Each EventData field (TargetUserName, LogonType, IpAddress, CommandLine…) gets its own column. Filter to a single Event ID first — 4624, 4688, Sysmon 1 — and you get a clean, analysis-ready table instead of a Message blob.

Optional raw XML column

Tick “Raw XML column” before exporting to add each event's full <Event> XML as the last column, for when you need a field the table does not show.

Excel-friendly encoding

The CSV is UTF-8 with a byte-order mark, so Excel opens accented user names, non-Latin paths and PowerShell script text without mangling them.

How to convert EVTX to CSV

1
Open the converterOpen the EVTX parser homepage. The WebAssembly parser loads in your tab; nothing is sent to a server.
2
Drop your .evtx fileDrag Security.evtx, System.evtx, a Sysmon or PowerShell log onto the drop zone, or click to pick one. Several files can be loaded together.
3
Filter, then Export CSVNarrow the rows with the filter bar, the Event ID chips or the timeline, then click Export CSV. Only the filtered rows are written, and the file downloads locally.

EVTX to CSV FAQ

How do I convert EVTX to CSV with PowerShell?: On Windows: Get-WinEvent -Path .\Security.evtx | Select-Object TimeCreated, Id, ProviderName, Message | Export-Csv events.csv -NoTypeInformation. It needs a Windows host and puts all event fields into the single Message column; the in-browser converter splits EventData into separate columns and runs on any OS.
Can Event Viewer save an EVTX file as CSV?: Yes: open the log, choose Save All Events As… and pick CSV (Comma Separated). The output keeps only the summary columns plus the rendered message text, so you lose the structured EventData fields.
How do I convert EVTX to CSV on Linux or macOS?: Use this browser-based converter, or a command-line tool such as EvtxECmd (--csv) or evtx_dump piped through a JSON-to-CSV step. All of them parse the binary format directly, without Windows.
Is my EVTX file uploaded during conversion?: No. The file is read into your browser's memory and converted there. You can disconnect from the network after the page loads and the conversion still works.