Generate timeline based on Windows Event logs using EvtxECmd.exe
EvtxECmd.exe -f "C:\path\to\single\log\security.etvx" --csvf "C:\output\folder" FileName
Or to generate a CSV based on multiple Evtx logs stored within a single directory (or recursive directories)
EvtxECmd.exe -d "C:\path\to\multiple\logs" --csvf "C:\output\folder" BigTimeline.csv
-f denotes single file
-d denotes directory to parse
-csv for directory, save file as default name (date/time format_Evtx_ECmd_Output.csv)
-csvf for directory and to set filename "BigTimeline.csv"