Powershell get win event FilterHashTable for a computername

Ok I am trying to find a account name by the last 30 days in the message box.
Our security logs go back so long and have co many log on and log off events piping it out to a where statement is unbelievable slow.
The only solution is to filter it right in the hash table but I cant make it work.
Here is what I have

Get-WinEvent -ComputerName MS01ADC  -FilterHashTable @{Logname='Security';Starttime=$([datetime]::Today.AddDays(-30))}  

Open in new window

Lets say I want a Account Name in the message box to match WS42south how can I do that with out resorting to what I have below since it takes a hour or more.   There must be a way to do it with out a pipe.  


Get-WinEvent -ComputerName MS01ADC  -FilterHashTable @{Logname='Security';Starttime=$([datetime]::Today.AddDays(-30))}   |? {$_.message -match "WS42south "}

Open in new window

Who is Participating?
Try the following.  There's only so much matching you can do inside the message without further processing.
Get-WinEvent -ComputerName MS01ADC -FilterHashTable @{Logname='Security'; Starttime=$([datetime]::Today.AddDays(-30)); data = "WS42south"}

Open in new window

GCPSlanopsAuthor Commented:
Perfect thank you
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.