1. PDQ Deploy & Inventory Help Center
  2. Community
  3. PowerShell
 

Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

PDQ Inventory report - dd/mm/yyyy dates not showing

Avatar
Iacobescu, Dan

Hello,

I wrote a PowerShell script to extract Event Viewer logs pertaining to a specific application error.
The script works, it gets all the columns from Event Viewer and stores them in a variable.

However when I create a PDQ Inventory report, the dd/mm/yyyy dates are missing, but the mm/dd/yyyy dates are.
These are the dates from the Date and Time column in Event Viewer.
The dates are there in the PS variable that extracts the logs.

Does PDQ Inventory only show dates based on a specific format?

Thank you, please let me know if I can get any additional details.

0

Comments

2 comments
Date Votes
  • Avatar
    dougd
    (Edited )

    Do you use get-winevent?  I haven't run into the issue you describe but I also don't deal with multiple locales with different time formats. Have you tried to store TimeCreated as [string] instead of the default [datetime]?

    $Query = '<QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[((Level=1  or Level=2) or (band(Keywords,4503599627370496))) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
      </Query>
    </QueryList>'
    Get-WinEvent -FilterXML $Query -ErrorAction SilentlyContinue | Select-Object | ForEach-Object {
        [PSCustomObject]@{
            Id          = $_.Id
            Provider    = $_.ProviderName
            Message     = $_.Message
            TimeCreated = $_.TimeCreated -as [string]
            Level       = $_.Level
        }
    }

     

     

    0
  • Avatar
    dougd
    (Edited )

    A better option might be to format TimeCreated as your PDQ installation prefers it and store it as a [datetime]:

    $Query = '<QueryList>
      <Query Id="0" Path="Application">
        <Select Path="Application">*[System[((Level=1  or Level=2) or (band(Keywords,4503599627370496))) and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
      </Query>
    </QueryList>'
    Get-WinEvent -FilterXML $Query -ErrorAction SilentlyContinue | Select-Object Id,ProviderName,Message, @{name='TimeCreated'; expression={$_.TimeCreated.ToString("MM-dd-yyyy hh:mm:ss tt")}} | ForEach-Object {
        [PSCustomObject]@{
            Id          = $_.Id
            Provider    = $_.ProviderName
            Message     = $_.Message
            TimeCreated = $_.TimeCreated -as [datetime]
        }
    }

     

     

     

     

    0