I need to query WMI for data less than 7 days old

I'm simply trying to pull data from the event log for errors and critical errors for the past 7 days. I'm having a problem doing the query using the WMI date format (UTC). I'd prefer to have this done within the query if possible. Can anyone help?

Looking for something like this:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > [TODAYS DATE - 7 DAYS]"



LVL 3
thomasd04Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

 
merowingerCommented:
0
 
thomasd04Author Commented:
Sorry, not quite sure how this would work. I need to the UTC date of 7 days ago in the query. Datediff gives me the difference between two dates; but I already have that number (7 days). I need to come up with the 'start' date. Or am I not understanding your suggestion?
0
 
merowingerCommented:
SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND DATEDIFF(YEAR,TIMEGENERATED,GETDATE()) > 7

You have to customize the command so that both dates have the same format for comparing them
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
thomasd04Author Commented:
Thanks! I'll check on this Monday when I go back to work.
0
 
RobSampsonCommented:
Hi, add this to the top of your code:
DateToCheck = DateAdd("d", -7, Now)
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate DateToCheck, True


and then use this in your query:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > " & strDateToCheck

Regards,

Rob.
0

Experts Exchange Solution brought to you by ConnectWise

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
 
thomasd04Author Commented:
Great suggestions. However, I'm using kix to pull the data and I don't have a DateAdd function to use. But this did give me an idea. I just need to pull current date in WMI format, subtract the 7 days, and then use it in the query. I just need to figure out how to get today's date in WMI.
0
 
thomasd04Author Commented:
Although I'm not using VBS the suggestions pointed me in the direction I needed to go to get the job done.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.