Parsing XML date to excel file returns "System.Xml.XmlElement" -- HELP PLEASE!

This topic contains 1 reply, has 2 voices, and was last updated by Profile photo of Cyril Muffat Cyril Muffat 1 year, 5 months ago.

  • Author
    Posts
  • #31231
    Profile photo of Meddy Med
    Meddy Med
    Participant

    Hey guys, Here is my code: I need help figuring out why the date is being exported like this. Also after that I would like as an added bonus if I can just have it only return the last event for a user, so if it sees that user again to skip, I tried to do it but failed not sure how to lay out the logic. I am a novice programmer just starting out and learning really.

    $query=@{
    #date = (Get-Date).AddHours(-40)
    id = 4624
    level = 0
    logname = "security"
    }
    $pc = $env:COMPUTERNAME
    $log = (Get-WinEvent -ComputerName $pc -FilterHashTable @{LogName=$query.logname; Level=$query.level; id=$query.id})

    [xml[]]$xmllog = $log.toXml()

    foreach ($i in $xmllog) {
    [int32]$a = $i.event.eventdata.data[8].'#text'
    if(($a -eq '7') -or ($a -eq '10')){
    $array = New-object PSObject -Property([ordered]@{`
    "Target Computer" = $i.Event.System.Computer
    "Time"=$i.Event.System.TimeCreated
    "User Logged In"=$i.Event.EventData.Data[5].'#text'
    #if($i.event.eventdata.data[5].'#text' -eq $i.event.eventdata.data[5].'#text'){continue}
    "Logon Type"=$i.Event.EventData.Data[8].'#text'
    "Ip Address"=$i.Event.EventData.Data[18].'#text'
    })

    }
    else{continue}

    $array |Export-Csv -NoTypeInformation C:\$pc.csv -Append

    }

  • #31265
    Profile photo of Cyril Muffat
    Cyril Muffat
    Participant

    Replace

    $i.Event.System.TimeCreated

    By

    [System.DateTime]$i.Event.System.TimeCreated.SystemTime

You must be logged in to reply to this topic.