Журнал событий по дате

Question

Я пытаюсь захватить файлы журнала с определенной даты, и я не получаю никаких результатов независимо от того, сколько дней я возвращаюсь.

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Select Message -ExpandProperty Message | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays('-1')) } 

Вот список файлов журнала

Message              TimeGenerated            
-------              -------------            
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/12/2017 3:58:45 AM          
Shutdown has occurred ...         1/12/2017 3:58:45 AM   

Answer 1

Ваш вопрос в том, что вы используете в Select командлет для расширения Message. Итак, когда вы пытаетесь фильтровать по TimeGenerated, что этого свойства нет. Если вам нужны только сообщения, выберите после фильтрации.

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays(-1)) } | Select -ExpandProperty Message