👀 Views: 0 💬 Answers: 1 📅 Created: 2025-06-16

powershell windows get-winevent PowerShell

I'm integrating two systems and Could someone explain I'm working on a project and hit a roadblock... I'm trying to filter Windows event logs using the `Get-WinEvent` cmdlet to retrieve events within a specific time range, but I'm running into issues. The filtering doesn't seem to work as expected when I specify a custom start and end time. Here’s the code I’ve been using: ```powershell $startTime = (Get-Date).AddDays(-7) # 7 days ago $endTime = Get-Date $logName = 'Application' Get-WinEvent -LogName $logName | Where-Object { $_.TimeCreated -ge $startTime -and $_.TimeCreated -le $endTime } ``` When I run this, I expect to see the events from the last week, but often I get events that are outside of that range. For example, I see events from over a month ago, and I'm not sure why. I’ve also tried using the `-FilterHashtable` parameter instead: ```powershell $filterHash = @{LogName=$logName; StartTime=$startTime; EndTime=$endTime} Get-WinEvent -FilterHashtable $filterHash ``` This approach ends up returning the same mixed results. I’ve confirmed that the `$startTime` and `$endTime` variables are correct by printing them out before the command. Additionally, I’ve checked the time zone settings on my system and they appear to be correct. Could there be something I'm missing in how the dates are being compared? Any help would be appreciated! My development environment is Ubuntu. Any ideas what could be causing this? I'm using Powershell LTS in this project. Is this even possible? Could someone point me to the right documentation?