guess i'll have to mess around with it more. i tried the date thing and it didn't work. here is my code:

$events_1030 = ReadEventlog('Application',1030,'2008/01/01 00:00:00')

i also tried this to no avail:

$events_1030 = ReadEventlog('SELECT EventCode, TimeGenerated, User FROM Win32_NTLogEvent WHERE Logfile="Application" AND EventCode=1030 AND TimeGenerated>="2008/01/01 00:00:00:000"')