Question

I want to get events of type error or critical with logfile = application from last week. This query works for first 2 conditions but I don’t know how to get only records from last week. I tried “And TimeGenerated > GETDATE()-7” but I got Invalid Query.

Select * from Win32_NTLogEvent where Logfile = 'Application' AND (type ='Error' OR type ='Critical')

Answer 1

Select * from Win32_NTLogEvent Where LogFile = 'Application' And (Type ='Error' Or Type ='Critical') And TimeGenerated > '20121117000000.000000+060' And TimeGenerated < '20121124000000.000000+060'

The +060 part depends on your time zone (I’m on GMT + 60 min). You can construct start and date strings dynamically.