Reputation: 328
So I got this code:
$events = Get-WinEvent -FilterHashtable @{logname='application'} |
Select Id,ProviderName,Message,TimeCreated
And it gives me the following output:
Id ProviderName Message TimeCreated
-- ------------ ------- -----------
327 ESENT svchost (664) The database engi... 28.07.2014 14:46:24
326 ESENT svchost (664) The database engi... 28.07.2014 14:46:24
8224 VSS The VSS service is shutting dow... 28.07.2014 14:40:23
903 Microsoft-Windows-Security-SPP The Software Protection service... 28.07.2014 14:39:40
16384 Microsoft-Windows-Security-SPP Successfully scheduled Software... 28.07.2014 14:39:40
...
How can I change the format of the dates to the "Full date and time (long date and long time) using universal time" like Thursday, August 30, 2007 6:21:52 PM?
Upvotes: 2
Views: 606
Reputation: 2537
This works:
$events = Get-WinEvent -FilterHashtable @{logname='application'} |
Select-object Id, ProviderName, Message, @{Name='TimeCreated';Expression={$_.TimeCreated.tostring('F')}}
and here are the standard format strings you can use:
http://msdn.microsoft.com/en-us/library/az4se3k1(v=vs.110).aspx
Upvotes: 1
Reputation: 2917
Here is another way:
$events = Get-WinEvent -FilterHashtable @{logname='application'} |
Select Id,ProviderName,Message,@{Label = "TimeCreated"; Expression = {Get-Date $_.TimeCreated -Format U}}
Upvotes: 2
Reputation: 1114
There are probably a couple ways to do it. Here is one example.
$events = Get-WinEvent -FilterHashtable @{logname='application'} |
Select-Object Id,ProviderName,Message,@{Name='TimeCreated';Expression={[String]::Format("{0:U}", $_.TimeCreated)}}
Upvotes: 1