Search code examples
windowspowershellget-winevent

How to get accurate event's systemtime via `Get-WinEvent` and DateCreated event's property?


I'm writing a script that has to export events to a CSV file. I want to add rows with accurate system time. What I don't get is how to extract the SystemTime property of TimeCreated. I.e. this one:

 TimeCreated 
   [SystemTime]  2016-10-25T20:04:47.824727500Z 

Here is a sample of the current output:

PS C:\Users\user> Get-WinEvent -LogName Application -MaxEvents 10 | Select-Object TimeCreated

TimeCreated
-----------
25.10.2016 23:04:47
25.10.2016 23:04:47
25.10.2016 23:04:17
25.10.2016 23:04:17
25.10.2016 23:04:17
25.10.2016 23:04:17
25.10.2016 23:04:16
25.10.2016 23:04:16
25.10.2016 23:04:16
25.10.2016 23:00:15

Update

I can add -ExpandProperty TimeCreated, but this results in adding extra columns such as Day, DayOfWeek, DayOfYear, Hour, Kind, Milliseconds, Minute, Month, Second, Ticks, TimeOfDay and it does not seem like -ExcludeProperty works for them.


Solution

  • What do yo mean by "get the SystemTime property"? The TimeCreated field of eventlog entries contains DateTime values, which don't have any such property. If you need the values in a particular format you can apply that format via a calculated property:

    Get-WinEvent -LogName Application -MaxEvents 10 |
      Select-Object @{n='TimeCreated';e={
        $_.TimeCreated.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.ffffffZ')
      }}