How to filter from xml to get boot duration using powershell?

Question

so here is code and it gives a table as an output.

$bootevents = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Diagnostics-Performance/Operational"; id=100} $bootevent = [xml]$bootevents[0].ToXml() $bootevent.Event.EventData.Data

If I want one entity record from Name like BootTime to be filtered and output instead of whole list/table being displayed,

what changes should be made?

Else could you advise any other way to get just boot duration using powershell?

thanks in advance,

Answer 1

To just get the boottime:

$bootevent.Event.EventData.Data | ? name -eq boottime

Name     #text
----     -----
BootTime 30234

By the way, newer powershells (6, 7) can filter the named eventdata data fields. And some filters can take wildcards. But there's a 256 element limit on the logname.

Get-WinEvent @{logname='*Diagnostics-Performance*'; boottime=30234}


   ProviderName: Microsoft-Windows-Diagnostics-Performance

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
4/12/2020 1:11:05 PM           100 Warning          Windows has started up: …