How to Use Date/Time Information From Custom Logs in PowerShell. Part 1 of 2.

PowerShell offers us some neat tools to help reduce our coding. In Part I, we are going to look at how to extract date/time information from the Windows event logs and do date/time math. In part II, we will look at how to use date/information from a third party log and utilize the same date/time methods that PowerShell offers us from the Windows logs.

Let’s look at the format that time is given to us in PowerShell.

Get-Date

Now, let’s look at how date/time data is represented from using the Get-EventLog cmdlet. We will be gathering data from the Application log for the demonstration.

Notice that we are provided the month in a thee character format. The day is present but not the year. The hour and minutes are in a 24 hour format. Let’s put the output of the event log into a variable.

$A = Get-EventLog “Application”

Note, this may take a few minutes. Once completed, we are going to determine the last event in the log. Since the objects of the event log are now stored in the array $A we can use the Count property to determine the upper limit of the array.

$a.Count

This array has 45,948 records from the application log (Remember, arrays start at zero but the counter starts at 1). Since these are objects, they have properties that we can work with.

$A[45948] | GM –MemberType Property

Now take a look at the TimeGenerated Property.

$A[45948].TimeGenerated

It is already in the same format as the output of the Get-Time command. Now the question comes, how do we find the difference between the two dates? Easy, we use the built in methods of PowerShell. Execute this line:

$Today = GetDate

Now that the current date/time information is stored in a variable, we can take a look at the methods available to us.

$Today | GM –MemberType Methods

Of interest to us is the Subtract method. Since the TimeGenerated property of the log file is already of the correct format, we can simple execute the following line of code:

$Today.Subtract($a[45948].TimeGenerated)

We can see the Date/Time difference. This is telling us how long ago this log entry was generated.

Next Tuesday, we are going to take a look at how to due this when your date/time information is coming from a third party log.