Use PowerShell to get a list of the most recent entries in the event log and manipulate the list according to your specific needs. For instance, the below PowerShell command helps you find all of the sources that are represented in the 1000 most recent entries in the System event log.
PS C:\>$events = get-eventlog -logname system -newest 1000
PS C:\>$events | group-object -property source -noelement | sort-object -property
You can start by getting the 1,000 most recent entries from the System event log and store the list in a $events variable. Then, use the pipeline operator to send the events in $events to the Group-Object cmdlet, which groups the entries by the value of the Source property.
A second pipeline operator will allow you to send the grouped events to the Sort-Object cmdlet, which sorts the list in descending order, so the most frequently appearing source is listed first.
