We help IT Professionals succeed at work.

Getting an event date in powershell

Trying to come up with a way to pull logs from a 2008 R2 server I've pieced together this powershell script from other users examples, but I can't find how how to get the TimeCreated value.  How can I get the event date?

Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName $PrintServer |
     Where-Object{$_.id -eq 307}|
     $strOutput = $PrintServer+ "," +$($_.Properties["TimeCreated"].Value)+ "," +$($_.Properties[1].Value)+ "," +$($_.Properties[2].Value)+ "," +$($_.Properties[4].Value)+ "," +$($_.Properties[3].Value)+ "," +$($_.Properties[6].Value)+ "," +$($_.Properties[7].Value)
		write-output $strOutput | Out-File $csvfile -append

Open in new window

The ...["TimeCreated"].Value doesn't work, it returns nothing.  The rest of that script gets the values from Param1, Param2, Param3, etc from the <UserData> XML section, but I need to get the date from the <System> section.
Watch Question

How about using $_.timecreated ?


Perfect - thank you!

Explore More ContentExplore courses, solutions, and other research materials related to this topic.