Analyze Windows event log text
How does the Windows Event Log Analyzer work?
Windows Event Viewer can contain thousands of entries, many of which are informational or unrelated to the symptom. This analyzer focuses on a small set of commonly useful crash, shutdown, disk, and application Event IDs.
It counts repeated IDs and creates a compact table without uploading the exported log.
Event grouping
Counts repeated Event IDs in the supplied content.
Priority reference
Highlights recognized shutdown, bugcheck, disk, and storage events.
Timeline support
Keeps recognizable timestamps with parsed event records.
Best practices before using the result
- Filter the log to the time window around the symptom before exporting.
- Include source, Event ID, timestamp, level, and message details where possible.
- Redact user names, computer names, file paths, and organization details before sharing logs publicly.
The analyzer reports only evidence found in the supplied content. “Not detected” does not prove a setting, component, or problem is absent.
When this utility is useful
Related TipsMake utilities
Frequently asked questions
Does Event ID 41 identify the cause of a restart?
No. It confirms Windows detected an unclean shutdown or restart, but power, hardware, thermal, driver, and software causes remain possible.
Can I upload an EVTX file?
This version accepts readable text, HTML, CSV, XML, or LOG content; binary EVTX parsing is not performed.
Why are some Event IDs ignored?
The tool groups recognizable entries and highlights a compact reference set. Unclassified events can still matter in context.
Are exported logs sent to TipsMake?
No. Supported files are read locally by the browser.