PS using Get-WinEvent with FilterXPath and datetime variables?
- by Jordan W.
I'm grabbing a handful of events from an event log in chronological order
don't want to pipe to Where
want to use get-winevent
After I get the Event1, I need to get the 1st instance of another event that occurs some unknown amount of time after Event1. then grab Event3 that occurs sometime after Event2 etc.
Basically starting with:
$filterXML = @'
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Kernel-General'] and (Level=4 or Level=0) and (EventID=12)]]</Select>
</Query>
</QueryList>
'@
$event1=(Get-WinEvent -ComputerName $PCname -MaxEvents 1 -FilterXml $filterXML).timecreated
Give me the datetime of Event1.
Then I want to do something like:
Get-WinEvent -LogName "System" -MaxEvents 1 -FilterXPath "*[EventData[Data = 'Windows Management Instrumentation' and TimeCreated -gt $event1]]"
Obviously the timecreated part bolded there doesn't work but I hope you get what I'm trying to do. any help?
