3

I've created my own event log called ScriptEvents that I use a few scripts to write to. What I'd like to do is run these commands (or something equivalent):

Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1
Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1

then compare their TimeCreated values and perform an action if the first event is older than the second.

This is the output of those commands:

   ProviderName: PauseSnapshots
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
9/26/2013 11:58:07 AM            1 Information      Replication has been paused....

   ProviderName: ResumeSnapshots
TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
9/26/2013 1:30:42 PM             0 Information      Replication has been resumed....

Any help would be appreciated.

1 Answers1

4

I'd probably just use Get-Date and compare as DateTime objects. The following will return True using your provided values.

$evtOne = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=1} -MaxEvents 1
$evtTwo = Get-WinEvent -FilterHashtable @{logname='ScriptEvents'; id=0} -MaxEvents 1
(Get-Date $evtOne.TimeCreated) -lt (Get-Date $evtTwo.TimeCreated)
jscott
  • 24,484
  • 8
  • 79
  • 100