3

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent):

Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1 Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1

then compare their TimeCreated values and perform an action if the first event is older than the second.

This is the output of those commands:

 ProviderName: PauseSnapshots TimeCreated Id LevelDisplayName Message ----------- -- ---------------- ------- 9/26/2013 11:58:07 AM 1 Information Replication has been paused.... ProviderName: ResumeSnapshots TimeCreated Id LevelDisplayName Message ----------- -- ---------------- ------- 9/26/2013 1:30:42 PM 0 Information Replication has been resumed....

Any help would be appreciated.

Improve this question

1 Answer 1

Reset to default
4

I'd probably just use Get-Date and compare as DateTime objects. The following will return True using your provided values.

$evtOne = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1 $evtTwo = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1 (Get-Date $evtOne.TimeCreated) -lt (Get-Date $evtTwo.TimeCreated)
Improve this answer
1
  • 1
    -FilterHashTable is nice! Commented Sep 27, 2013 at 16:01

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.