Skip to content

Instantly share code, notes, and snippets.

@ChrisLGardner
Last active March 30, 2020 13:59
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ChrisLGardner/f00f15888b60e6b7166be83b2d761ac5 to your computer and use it in GitHub Desktop.
Save ChrisLGardner/f00f15888b60e6b7166be83b2d761ac5 to your computer and use it in GitHub Desktop.
$arr = @("25.02.2020 10:11:58"
"25.02.2020 10:12:21"
"25.02.2020 11:03:37"
"25.02.2020 11:03:37"
"25.02.2020 11:35:28"
"25.02.2020 11:35:32"
"25.02.2020 12:40:03"
"25.02.2020 14:08:11"
"25.02.2020 14:09:49"
"25.02.2020 14:39:44"
"26.02.2020 08:55:00"
"26.02.2020 09:18:09"
"26.02.2020 09:45:26"
"26.02.2020 09:48:05"
"26.02.2020 09:57:21"
"26.02.2020 10:00:37")
$Result = Foreach ($item in $arr)
{
$date = Get-Date $item
$Oldest = ($date).AddMinutes(-1)
$Newest = ($date).AddMinutes(+1)
$logs = Get-WinEvent -MaxEvents 5 -FilterHashTable @{
LogName = "Application","System"
StartTime = $Oldest
EndTime = $Newest
}
if ($logs)
{
## Add empty lines so the seperation between targets is a bit more visible in ogv, delete this when explorting to CSV
[PSCustomObject]@{
TargetTime = ""
EventTime = ""
Computer = ""
EventId = ""
ProviderName = ""
message = ""
}
foreach ($log in $logs)
{
[PSCustomObject]@{
TargetTime = $item
LogName = $log.LogName
EventTime = $Log.TimeCreated
Computer = $log.MachineName
EventId = $Log.Id
ProviderName = $log.ProviderName
message = $log.Message.Trim("")
}
}
}
else
{
Write-host $item -ForegroundColor Cyan
[PSCustomObject]@{
TargetTime = $item
EventTime = "No Data was found on $item"
Computer = "No Data was found on $item"
EventId = "No Data was found on $item"
ProviderName = "No Data was found on $item"
message = "No Data was found on $item"
}
}
}
$Result | ogv
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment