I need to query WMI for data less than 7 days old
I'm simply trying to pull data from the event log for errors and critical errors for the past 7 days. I'm having a problem doing the query using the WMI date format (UTC). I'd prefer to have this done within the query if possible. Can anyone help?
Looking for something like this:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > [TODAYS DATE - 7 DAYS]"
Looking for something like this:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > [TODAYS DATE - 7 DAYS]"
ASKER
Sorry, not quite sure how this would work. I need to the UTC date of 7 days ago in the query. Datediff gives me the difference between two dates; but I already have that number (7 days). I need to come up with the 'start' date. Or am I not understanding your suggestion?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks! I'll check on this Monday when I go back to work.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Great suggestions. However, I'm using kix to pull the data and I don't have a DateAdd function to use. But this did give me an idea. I just need to pull current date in WMI format, subtract the 7 days, and then use it in the query. I just need to figure out how to get today's date in WMI.
ASKER
Although I'm not using VBS the suggestions pointed me in the direction I needed to go to get the job done.
http://msdn.microsoft.com/de-de/library/ms189794.aspx