以日期記錄事件

我試圖捕獲特定日期的日誌文件，無論我回去多少天，我都沒有收到任何結果。以日期記錄事件

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Select Message -ExpandProperty Message | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays('-1')) }

下面是日誌文件的列表

Message              TimeGenerated            
-------              -------------            
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/18/2017 12:01:52 AM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/16/2017 7:01:53 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/15/2017 2:01:39 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/14/2017 1:58:47 PM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/13/2017 8:58:46 AM          
Shutdown has occurred ...         1/12/2017 3:58:45 AM          
Shutdown has occurred ...         1/12/2017 3:58:45 AM

來源

2017-01-19 JRN

你的問題是，你使用的Select cmdlet來擴大Message。那麼當你試圖在TimeGenerated上過濾那個屬性是不存在的。如果您只需要這些消息，請在過濾後選擇。

Get-EventLog -LogName Application -EntryType Warning -Source MicrosoftDynamicsNAVClientWebClient | Where { ($_.Message -match 'Shutdown') -and ($_.TimeGenerated -gt [datetime]::Today.AddDays(-1)) } | Select -ExpandProperty Message

來源

2017-01-19 14:55:16 BenH

我總是因爲這個格式化錯誤而陷入困境。我一遍又一遍地犯這個錯誤。我猜它的秩序感讓我感到不安，我喜歡事前正確地看到事情，而不是事後做好一切並進行格式化。謝謝你給我一些感覺。非常好，簡潔的答案。 – JRN

以日期記錄事件

回答

相關問題