FilterhashTable

The bottom powershell steps work to get the computer boot processing steps. Can anyone advise if there is a method to achieve the same result using the Get-winevent -FilterhashTable? The activityID and correlation are buried inside the XML of the respective events, I am having a little difficulty figuring out if this is even accessible using the -filterhashtable

Thanks

$Query = ’ *[System[(EventID=“4000”)]] ’

$ugevent=Get-WinEvent -FilterXml $Query -ComputerName $cmp| select -First 1

$Query = ’ *[System/Correlation/@ActivityID="{CorrelationID}"] ’

$FilterXML = $Query.Replace(“CorrelationID”,$ugevent.ActivityID)

Get-WinEvent -FilterXML $FilterXML -ComputerName $cmp | Out-GridView

There are a lot of examples of using -FilterScript, specifically for Boot information:

http://www.happysysadm.com/2014/07/windows-boot-history-and-boot.html
http://www.normanbauer.com/2012/01/10/how-to-get-detailed-information-on-windows-boot-and-shutdown-performance-in-powershell/
https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/15/use-powershell-and-a-filter-hash-table-to-speed-boot-trace/