0

I am writing a VBScript which attempts to query the WMI system logs for start up and shutdowns within the current month and unfortunately I'm hitting an automation error with the query I have created.

I have a function that will dynamically create a UTC for the start and end of the month (at least I think it does and it looks right) and then add it to the query string, which looks like this:

Select * from Win32_NTLogEvent
Where Logfile = 'System' and
  (EventCode = '12' or EventCode = '13') AND
  (TimeWritten is between '2015101000000.000000-000' and '2015131235959.000000-000')

I have tried substituting the single quotes for double quotes (using CHR(34) as I don't know any better).

I hoped somebody may be able to point out the error in my ways and explain why this query is not working.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
Alex Vincent
  • 3
  • 2
  • You can use normal date formats (e.g. `10/10/2015`) in your queries too which is much easier and then allows you to do date formulas like `TimeWritten >= Date - 1 AND TimeWritten <= Date` (to get yesterday's events). You can play around with it to see what I mean. – Sum None Dec 23 '18 at 11:23

1 Answers1

0

WQL doesn't have a between operator and both your dates are invalid (you have yyyyMddHHmmss.ffffff±zzz when you should have yyyyMMddHHmmss.ffffff±zzz).

Change

TimeWritten is between '2015101000000.000000-000' and '2015131235959.000000-000'

into

TimeWritten >= '20150101000000.000000-000' and TimeWritten <= '20150131235959.000000-000'
Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
  • A million thanks indeed, not only did I miss that missing single digit but I have also learnt that WQL doesn't have a between operator. I have corrected and successfully reran my code. – Alex Vincent Jan 05 '15 at 16:57