Event Log Filtering for Event ID and Date

PowerShell Help
1

Hi All,

I have this line that I found online and it’s wonderful, it helps a ton!

Get-WinEvent -ComputerName XYZ -FilterHashtable @{LogName = "System"; id = 1074}

I’m trying to append that for a different log and for a specific date. I’ve tried multiple variations of this but can’t get it to work. Hoping someone can help.

Get-WinEvent -ComputerName XYZ -FilterHashtable @{LogName = "Security"; id = 4624; TimeCreated -like "*6/8/2022*"}

I’ve tried -eq, -match, -contains for the TimeCreated attribute.

Looking to get all event IDs of 4624 for the date of 6/8/2022

Also, maybe if I could just get the date/time and logon username that would be even better.

Thank you in advance!

2

In PowerShell we work with objects and properties - not strings! :smirk: You can specify a start date and time and an end date and time.

Please always read the help for the cmdlets you’re about to use completely including the examples to learn how to use them.

1 Like