Skip to main content

How to Use Date/Time Information From Custom Logs in PowerShell. Part 1 of 2.

By

PowerShell offers us some neat tools to help reduce our coding. In Part I, we are going to look at how to extract date/time information from the Windows event logs and do date/time math. In part II, we will look at how to use date/information from a third party log and utilize the same date/time methods that PowerShell offers us from the Windows logs.

Let’s look at the format that time is given to us in PowerShell.

Get-Date


Now, let’s look at how date/time data is represented from using the Get-EventLog cmdlet. We will be gathering data from the Application log for the demonstration.


Notice that we are provided the month in a thee character format. The day is present but not the year. The hour and minutes are in a 24 hour format. Let’s put the output of the event log into a variable.

$A = Get-EventLog “Application”

Note, this may take a few minutes. Once completed, we are going to determine the last event in the log. Since the objects of the event log are now stored in the array $A we can use the Count property to determine the upper limit of the array.

$a.Count


This array has 45,948 records from the application log (Remember, arrays start at zero but the counter starts at 1). Since these are objects, they have properties that we can work with.

$A[45948] | GM –MemberType Property


Now take a look at the TimeGenerated Property.

$A[45948].TimeGenerated


It is already in the same format as the output of the Get-Time command. Now the question comes, how do we find the difference between the two dates? Easy, we use the built in methods of PowerShell. Execute this line:

$Today = GetDate

Now that the current date/time information is stored in a variable, we can take a look at the methods available to us.

$Today | GM –MemberType Methods


Of interest to us is the Subtract method. Since the TimeGenerated property of the log file is already of the correct format, we can simple execute the following line of code:

$Today.Subtract($a[45948].TimeGenerated)


We can see the Date/Time difference. This is telling us how long ago this log entry was generated.

Next Tuesday, we are going to take a look at how to due this when your date/time information is coming from a third party log.



Labels:

Comments

Post a Comment

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

By
As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th
Post a Comment
Read more

Return duplicate values from a collection with PowerShell

By
If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe
Post a Comment
Read more

How to list all the AD LDS instances on a server

By
AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.
Post a Comment
Read more