Important Notice: On February 29th, this community will be put into read-only mode. All existing posts will remain but customers will be unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

PDQ Inventory report - dd/mm/yyyy dates not showing

Hello,

I wrote a PowerShell script to extract Event Viewer logs pertaining to a specific application error.
The script works, it gets all the columns from Event Viewer and stores them in a variable.

However when I create a PDQ Inventory report, the dd/mm/yyyy dates are missing, but the mm/dd/yyyy dates are.
These are the dates from the Date and Time column in Event Viewer.
The dates are there in the PS variable that extracts the logs.

Does PDQ Inventory only show dates based on a specific format?

Thank you, please let me know if I can get any additional details.

0

Comments

2 comments
Date Votes
  • Do you use get-winevent?  I haven't run into the issue you describe but I also don't deal with multiple locales with different time formats. Have you tried to store TimeCreated as [string] instead of the default [datetime]?

    $Query = '<QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[((Level=1  or Level=2) or (band(Keywords,4503599627370496))) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
      </Query>
    </QueryList>'
    Get-WinEvent -FilterXML $Query -ErrorAction SilentlyContinue | Select-Object | ForEach-Object {
        [PSCustomObject]@{
            Id          = $_.Id
            Provider    = $_.ProviderName
            Message     = $_.Message
            TimeCreated = $_.TimeCreated -as [string]
            Level       = $_.Level
        }
    }

     

     

    0
  • A better option might be to format TimeCreated as your PDQ installation prefers it and store it as a [datetime]:

    $Query = '<QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[((Level=1  or Level=2) or (band(Keywords,4503599627370496))) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
      </Query>
    </QueryList>'
    Get-WinEvent -FilterXML $Query -ErrorAction SilentlyContinue | Select-Object Id,ProviderName,Message, @{name='TimeCreated'; expression={$_.TimeCreated.ToString("MM-dd-yyyy hh:mm:ss tt")}} | ForEach-Object {
        [PSCustomObject]@{
            Id          = $_.Id
            Provider    = $_.ProviderName
            Message     = $_.Message
            TimeCreated = $_.TimeCreated -as [datetime]
        }
    }

     

     

     

     

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post