按日期排列的事件日志答案

【问题标题】：Event Log by date按日期排列的事件日志
【发布时间】：2017-06-03 15:15:48
【问题描述】：

我正在尝试从特定日期捕获日志文件，但无论我返回多少天都没有得到任何结果。

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Select Message -ExpandProperty Message | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays('-1')) }

这里是日志文件列表

Message                                                     TimeGenerated                                              
-------                                                     -------------                                              
Shutdown has occurred ...                                   1/18/2017 12:01:52 AM                                      
Shutdown has occurred ...                                   1/18/2017 12:01:52 AM                                      
Shutdown has occurred ...                                   1/18/2017 12:01:52 AM                                      
Shutdown has occurred ...                                   1/16/2017 7:01:53 PM                                       
Shutdown has occurred ...                                   1/16/2017 7:01:53 PM                                       
Shutdown has occurred ...                                   1/16/2017 7:01:53 PM                                       
Shutdown has occurred ...                                   1/15/2017 2:01:39 PM                                       
Shutdown has occurred ...                                   1/15/2017 2:01:39 PM                                       
Shutdown has occurred ...                                   1/15/2017 2:01:39 PM                                       
Shutdown has occurred ...                                   1/14/2017 1:58:47 PM                                       
Shutdown has occurred ...                                   1/14/2017 1:58:47 PM                                       
Shutdown has occurred ...                                   1/14/2017 1:58:47 PM                                       
Shutdown has occurred ...                                   1/13/2017 8:58:46 AM                                       
Shutdown has occurred ...                                   1/13/2017 8:58:46 AM                                       
Shutdown has occurred ...                                   1/13/2017 8:58:46 AM                                       
Shutdown has occurred ...                                   1/12/2017 3:58:45 AM                                       
Shutdown has occurred ...                                   1/12/2017 3:58:45 AM

【问题讨论】：

标签： powershell logging get-eventlog

【解决方案1】：

您的问题是您使用Select cmdlet 来扩展Message。因此，当您尝试过滤 TimeGenerated 时，该属性不存在。如果您只想要消息，请在过滤后选择。

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays(-1)) } | Select -ExpandProperty Message

【讨论】：

我永远被那个格式错误所困扰。我一遍又一遍地犯这个错误。我想是我的秩序感把我搞砸了谢谢你让我明白了本。非常好的简洁的答案。