We help IT Professionals succeed at work.

Getting an event date in powershell

Trying to come up with a way to pull logs from a 2008 R2 server I've pieced together this powershell script from other users examples, but I can't find how how to get the TimeCreated value.  How can I get the event date?

Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName $PrintServer |
     Where-Object{$_.id -eq 307}|
     ForEach-Object{
     $strOutput = $PrintServer+ "," +$($_.Properties["TimeCreated"].Value)+ "," +$($_.Properties[1].Value)+ "," +$($_.Properties[2].Value)+ "," +$($_.Properties[4].Value)+ "," +$($_.Properties[3].Value)+ "," +$($_.Properties[6].Value)+ "," +$($_.Properties[7].Value)
		write-output $strOutput | Out-File $csvfile -append
}

Open in new window


The ...["TimeCreated"].Value doesn't work, it returns nothing.  The rest of that script gets the values from Param1, Param2, Param3, etc from the <UserData> XML section, but I need to get the date from the <System> section.
Comment
Watch Question

Commented:
How about using $_.timecreated ?

Author

Commented:
Perfect - thank you!

Explore More ContentExplore courses, solutions, and other research materials related to this topic.