Solved

powershell datetime parse help

Posted on 2014-09-22
6
253 Views
Last Modified: 2014-09-24
Hello EE,

I have a a creation date in string format from gwmi win32_process , it returns a date format that is unusual , how do I parse this correctly, as the nano seconds after the seconds does not have a character format that I am aware of ?

20140913014133.145231+000

 {[datetime]::ParseExact($_.CreationDate,????? ,$null)}
0
Comment
Question by:davesnb
6 Comments
 
LVL 16

Accepted Solution

by:
Dale Harris earned 400 total points
Comment Utility
Does this work for you?

[DateTime]::ParseExact($_.CreationDate.substring(0,14),'yyyyMMddhhmmss',$null)
0
 
LVL 28

Assisted Solution

by:becraig
becraig earned 100 total points
Comment Utility
You can also just split the date (though the substring should work as well)

 [DateTime]::ParseExact(($_creationDate.split(".")[0]), 'yyyyMMddHHmmss', $null)

Open in new window

0
 

Author Closing Comment

by:davesnb
Comment Utility
Works great, thank you
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 16

Expert Comment

by:Dale Harris
Comment Utility
You need to be careful not to use the HH since it needs to be in 12 hour format, not 24 in order for it to properly parse.  But yes, either way whether you split it or substring it should work just fine.
0
 
LVL 68

Expert Comment

by:Qlemo
Comment Utility
Usually that is a sufficient way to convert WMI Dates, but the "officially correct" way is to use this:
[ManagementDateTimeConverter]::ToDateTime($_.creationDate)

Open in new window

This allows for adjustment of time zone info, which can get important if you use a remote WMI query.
0
 
LVL 39

Expert Comment

by:footech
Comment Utility
I know the question is already answered, but was just going through my email alerts.
The other way that I've always seen is to use the ConvertToDateTime method that is added to all WMI objects returned by PowerShell.  Quick example.
$a = gwmi win32_process -filter "name = 'svchost.exe'"
$a | % { $_.ConvertToDateTime($_.CreationDate) }

Open in new window

0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
This is a PowerShell web interface I use to manage some task as a network administrator. Clicking an action button on the left frame will display a form in the middle frame to input some data in textboxes, process this data in PowerShell and display…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now