|
Why doesnt this work?
If I do a query on the NT eventlog using WMI on the date only it works fine. If I then want to reduce the search results by adding in the time to the search query is doesn't work.
Note: I've tried it without subtracting 1 from $the_hour and just changing the system time to one hour ago and it still doesnt work.
I am wondering if its down to the varibles only holding a limited number size?
Code as follows:
Break on
Generate_simple_date_varibles ()
$the_hour = Val($the_hour) If $the_hour > 1 $the_hour = $the_hour - 1 EndIf
$Eventvwr_Date = $the_year + $the_month + $the_day + $the_hour + $the_minute + $the_second ;$Eventvwr_Date = $the_year + $the_month + $the_day ; This works with no time - why?
?"Search date time: $Eventvwr_Date"?
$EventLog_count_All = 0 $Eventvwr_log = Application $Eventvwr_Type = information
$events = GetObject("Winmgmts:\\@WKSTA").ExecQuery("Select * from Win32_NTLogEvent Where Type = '$Eventvwr_Type' AND Logfile = '$Eventvwr_log' AND TimeWritten >= '$Eventvwr_Date' ") For Each $event In $events
?"Orig EVT date time: " + $event.TimeWritten $EventLog_count_All = $EventLog_count_All + 1
Next
??"Count is $EventLog_count_All"
?"press any key" Get $dummy Exit
Function Generate_simple_date_varibles ()
$the_date_unstripped = @DATE $the_time_unstripped = @TIME $the_year = SubStr($the_date_unstripped,1,4) $the_month = SubStr($the_date_unstripped,6,2) $the_day = SubStr($the_date_unstripped,9,2) $the_hour = SubStr($the_time_unstripped,1,2) $the_minute = SubStr($the_time_unstripped,4,2) $the_second = SubStr($the_time_unstripped,7,2) EndFunction
|