> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/log-files-1/windows/generating-log-timelines.md).

# Generating Log Timelines

Generate timeline based on Windows Event logs using EvtxECmd.exe

```
EvtxECmd.exe -f "C:\path\to\single\log\security.etvx" --csvf "C:\output\folder" FileName

Or to generate a CSV based on multiple Evtx logs stored within a single directory (or recursive directories)

EvtxECmd.exe -d "C:\path\to\multiple\logs" --csvf "C:\output\folder" BigTimeline.csv

-f denotes single file
-d denotes directory to parse
-csv for directory, save file as default name (date/time format_Evtx_ECmd_Output.csv)
-csvf for directory and to set filename "BigTimeline.csv"
```

Review CSV using [timeline explorer](https://ericzimmerman.github.io/#!index.md)