PS using Get-WinEvent with FilterXPath and datetime variables?

Question

• I'm grabbing a handful of events from an event log in chronological order
• don't want to pipe to Where
• want to use get-winevent

After I get the Event1, I need to get the 1st instance of another event that occurs some unknown amount of time after Event1. then grab Event3 that occurs sometime after Event2 etc.

Basically starting with:

$filterXML = @'
<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Kernel-General'] and (Level=4 or Level=0) and (EventID=12)]]</Select>
  </Query>
</QueryList>
'@    
$event1=(Get-WinEvent -ComputerName $PCname -MaxEvents 1 -FilterXml $filterXML).timecreated

Give me the datetime of Event1. Then I want to do something like:

Get-WinEvent -LogName "System" -MaxEvents 1 -FilterXPath "*[EventData[Data = 'Windows Management Instrumentation' and TimeCreated -gt $event1]]"

Obviously the timecreated part bolded there doesn't work but I hope you get what I'm trying to do. any help?

---

I think perhaps filterhashtable is how I need to go? looking for clarification:

$Event2=(Get-WinEvent -Oldest -MaxEvents 1 -FilterHashtable @{logname="system"; providername="Microsoft-Windows-GroupPolicy"; starttime=$Event1}).TimeCreated

Answer 1

This is what you want ...

$t = (((Get-WinEvent -ComputerName $PCname -MaxEvents 1 -FilterXml $filterXML).TimeCreated).ToUniversalTime()).ToString("s")

As an aside, I need the time the computer started, so did something like this ...

$t1 = (((Get-WinEvent -ComputerName "myhostname" -LogName "System" -MaxEvents 1 -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Kernel-General']][EventID=12]]").TimeCreated).ToUniversalTime()).ToString("s")

OR

$t1 = (($boottime.ConvertToDateTime($boottime.LastBootUpTime)).ToUniversalTime()).ToString("s")

THEN

(Get-WinEvent -ComputerName "myhostname" -LogName "Application" -MaxEvents 1 -FilterXPath "*[System[TimeCreated[@SystemTime>'$t1']][EventID=6005]][EventData[Data='Sens' and Data='Logoff']]")|fl

OR

(Get-WinEvent -ComputerName "myhostname" -LogName "Application" -MaxEvents 1 -FilterXPath "*[System[TimeCreated[@SystemTime>'$t1']][EventID=6005]][EventData[Data='Sens' and Data='Logoff']]").Count