• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1213
  • Last Modified:

I need to query WMI for data less than 7 days old

I'm simply trying to pull data from the event log for errors and critical errors for the past 7 days. I'm having a problem doing the query using the WMI date format (UTC). I'd prefer to have this done within the query if possible. Can anyone help?

Looking for something like this:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > [TODAYS DATE - 7 DAYS]"



0
thomasd04
Asked:
thomasd04
  • 4
  • 2
2 Solutions
 
merowingerCommented:
0
 
thomasd04Author Commented:
Sorry, not quite sure how this would work. I need to the UTC date of 7 days ago in the query. Datediff gives me the difference between two dates; but I already have that number (7 days). I need to come up with the 'start' date. Or am I not understanding your suggestion?
0
 
merowingerCommented:
SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND DATEDIFF(YEAR,TIMEGENERATED,GETDATE()) > 7

You have to customize the command so that both dates have the same format for comparing them
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
thomasd04Author Commented:
Thanks! I'll check on this Monday when I go back to work.
0
 
RobSampsonCommented:
Hi, add this to the top of your code:
DateToCheck = DateAdd("d", -7, Now)
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
dtmStartDate.SetVarDate DateToCheck, True


and then use this in your query:
"SELECT * from Win32_NTLogEvent WHERE Logfile = 'System' AND TYPE = 'ERROR' AND TIMEGENERATED > " & strDateToCheck

Regards,

Rob.
0
 
thomasd04Author Commented:
Great suggestions. However, I'm using kix to pull the data and I don't have a DateAdd function to use. But this did give me an idea. I just need to pull current date in WMI format, subtract the 7 days, and then use it in the query. I just need to figure out how to get today's date in WMI.
0
 
thomasd04Author Commented:
Although I'm not using VBS the suggestions pointed me in the direction I needed to go to get the job done.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now