rgrep.1 -E '^\$.*Add-Content' powershell.evtx.log
print lines matching a pattern
source manpages: rgrep