title: Wevtutil to output only new event logs
body: <p>I run the command <code>wevtutil qe Application /rd:false /f:text</code> and  I get an output as shown below. After sometime new event logs could have generated and I want to read only these new event logs i.e. Event[2],  Event[3], Event[4] etc.</p>
  
  <p>How can I use <code>wevtutil</code> tool to generate only these new event logs?</p>
  
  <p>Event[0]:</p>
  
  <ul>
  <li>Log Name: Application</li>
  <li>Source: Microsoft-Windows-LoadPerf</li>
  <li>Date: 2016-04-21T23:15:16.832</li>
  <li>Event ID: 1000</li>
  <li>Task: N/A</li>
  <li>Level: Information</li>
  <li>Opcode: Info</li>
  <li>Keyword: N/A</li>
  <li>User: S-1-5-18</li>
  <li>User Name: NT AUTHORITY\SYSTEM</li>
  <li>Computer: WIN-IONOGQTF9O5</li>
  <li>Description: 
  Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service.</li>
  </ul>
  
  <p>Event[1]:</p>
  
  <ul>
  <li>Log Name: Application</li>
  <li>Source: Microsoft-Windows-LoadPerf</li>
  <li>Date: Date: 2016-04-21T23:15:13.097</li>
  <li>Event ID: 3011</li>
  <li>Task: N/A</li>
  <li>Level: Information</li>
  <li>Opcode: Info</li>
  <li>Keyword: N/A</li>
  <li>User: S-1-5-18</li>
  <li>User Name: NT AUTHORITY\SYSTEM</li>
  <li>Computer: WIN-IONOGQTF9O5</li>
  <li>Description: 
  Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.</li>
  </ul>