CODEWITHSUNDEEP
powershelleventslogging
Ismail Kaleem
Ismail Kaleem

Reputation: 35

Get-WinEvent Select time and field within data item of 1

I am trying to view all events in 7045 where i am able to extract path name. However I want to select the timestamp of the event as well?

Get-WinEvent -Path ".\System.evtx" |
  where {$_.id -eq "7045"} |
    Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").itemOf(1)} |
      Select -ExpandProperty "#text" -Unique

Get-WinEvent -Path ".\System.evtx" |
  where {$_.id -eq "7045"} |
    Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").itemOf(1)} | 
      Select -ExpandProperty "#text" -Unique

Get-WinEvent -Path ".\System.evtx" |
  where {$_.id -eq "7045"} |
    Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").itemOf(0)} |
      Select -ExpandProperty "#text" -Unique

i want to get the output TimeCreated, Service Name, Service Path

At moment with 2 queries i can get the service name & then the service path?

Upvotes: 1

Views: 234

Answers (1)

TessellatingHeckler
TessellatingHeckler

Reputation: 28963

This might do it:

Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045} |
    Select-Object -Property TimeCreated, 
                            @{Label='Service Name'; Expression={$_.properties[0].Value}}, 
                            @{Label='Service Path'; Expression={$_.properties[1].Value}}

Upvotes: 3

Related Questions