Search code examples
powershellpowershell-2.0event-log

Powershell: filtering event logs


Ive written a small script to retreive event logs from application for the last 10 days but i receive the error. Any ideas why the error appear?

Where-Object : Cannot bind parameter 'FilterScript'. Cannot convert value "False" to type "System.Management.Automation.ScriptBlock". Error: "Invalid cast from 'System.Boolean' to 'System.Management.Automation.ScriptBlock'."

#Sets the application log to query 
$Log ="Application"
$FilterHashTable = @{LogName=$Log}

#stores the computer name 
$ComputerName = $env:COMPUTERNAME 

#sets the date 10 days ago 
$DeleteDate = Get-Date 
$DeleteDate = $DeleteDate.AddDays(-10) 
Write-Verbose $DeleteDate 

#retrieve WMIevent and logs the information 
$Winevent = Get-WinEvent -ComputerName $ComputerName -FilterHashTable $FilterHashTable  -ErrorAction SilentlyContinue

# Filter on time 
$Winevent | where-object ($_.timecreated -gt $DeleteDate)

Solution

  • Where-Object needs a scriptblock parameter - use curly braces {...} not parentheses (...) to contain your filter logic.

    Currently PS is checking your criteria and returning a boolean, instead of applying it as a filter.