Get-EventLog -Log "Microsoft-Windows-Ntfs/Operational" fails with "does not exist"

Question

I am making a script that pulls all non-empty logs and saves them as either evtx, csv, or xml. I have got the script working for the base logs (application, security, system, etc.), and those that have spaces. However, I keep getting errors with any that have forward slashes (/) in them (e.g. Microsoft-Windows-Ntfs/Operational). I tried swapping the / out with dash, spaces, abbreviated, and underscores: they all result in the error below.

Note: I am am using -newest 20 in the code for testing, to ease the load and save time.

Example of Code (Get the same results with either):

get-eventlog -log "Microsoft-Windows-Ntfs/Operational" -newest 20

OR

$Logname = "Microsoft-Windows-Ntfs/Operational"
get-eventlog -log $logname -newest 20`

ERROR:

get-eventlog : The event log 'Microsoft-Windows-Ntfs/Operational' on computer '.' does not exist.
At line:1 char:1
+ get-eventlog -log "Microsoft-Windows-Ntfs/Operational" -newest 20
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-EventLog], InvalidOperationException
    + FullyQualifiedErrorId : System.InvalidOperationException,Microsoft.PowerShell.Commands.GetEventLogCommand

Answer 1

Get-EventLog only sees this

> get-eventlog -List

  Max(K) Retain OverflowAction        Entries Log
  ------ ------ --------------        ------- ---
  20’480      0 OverwriteAsNeeded      18’888 Application
  20’480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
  20’480      0 OverwriteAsNeeded           0 Key Management Service
  15’360      0 OverwriteAsNeeded      19’094 Operations Manager
                                              Security
   8’192      0 OverwriteAsNeeded       7’012 Symantec Endpoint Protection Client
  20’480      0 OverwriteAsNeeded     102’800 System
  15’360      0 OverwriteAsNeeded      14’144 Windows PowerShell

In addition, the documentation also states

Get-EventLog uses a Win32 API that is deprecated. The results may not be accurate. Use the `Get-WinEvent? cmdlet instead.

Thus use Get-WinEvent, which works fine:

Get-WinEvent -LogName "Microsoft-Windows-Ntfs/Operational"


   ProviderName: Microsoft-Windows-Ntfs

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
21.06.2021 01:24:48            142 Information      Summary of disk space usage, since last event:...
21.06.2021 01:24:38            142 Information      Summary of disk space usage, since last event:...
21.06.2021 01:24:38            142 Information      Summary of disk space usage, since last event:...
20.06.2021 01:24:44            142 Information      Summary of disk space usage, since last event:...