I have the following event log query where I need to filter by event ID and specific date range for the Time Created. Here is what I current have:
var _PRINTINGDOCUMENTEVENTID = "307";
var startTime = System.DateTime.Now.AddMinutes(-10);
var endTime = System.DateTime.Now
var query = string.Format("*[[System/EventID={0}] and [System[TimeCreated[@SystemTime >= {1}]]] and [System[TimeCreated[@SystemTime <= {2}]]]", _PRINTINGDOCUMENTEVENTID, startTime.ToUniversalTime().ToString("o"), endTime.ToUniversalTime().ToString("o"));)
var logQuery = new EventLogQuery("Microsoft-Windows-PrintService/Operational", PathType.LogName, query );
var reader = new EventLogReader(logQuery);
I get the following error when I try to debug the event log query:
The specified query is invalid
Here is what the query
value looks like while debugging:
"*[[System/EventID=307] and [System[TimeCreated[@SystemTime >= 2016-03-28T22:51:23.9082575Z]]] and [System[TimeCreated[@SystemTime <= 2016-03-28T23:01:23.9092576Z]]]"
How do I fix this issue?
I was able to determine the correct format for filtering by event id and a date range for TimeCreated
var eventId = "307";
var startTime = System.DateTime.Now.AddMinutes(-10);
var endTime = System.DateTime.Now;
var query = string.Format(@"*[System/EventID={0}] and *[System[TimeCreated[@SystemTime >= '{1}']]] and *[System[TimeCreated[@SystemTime <= '{2}']]]",
eventId,
startTime.ToUniversalTime().ToString("o"),
endTime.ToUniversalTime().ToString("o"));