使用power shell按天和时间跨度筛选活动日志条目

如果不想创建日期边界:

Get-Eventlog -LogName system -Source user32 |
    Where-Object { $_.TimeGenerated.DayOfWeek -ge ([DayOfWeek]'Monday') -and $_.TimeGenerated.DayOfWeek -le ([DayOfWeek]'Friday') -and $_.TimeGenerated.Hour -ge 6 -and $_.TimeGenerated.Hour -lt 16 } |
    Select-Object TimeGenerated, EntryType, Message

创建日期边界可能会更有效,尤其是如果您只想返回几周,那么可以在Get EventLog上输入Before和After参数。为此使用Where Object效率较低。

这就是您需要的:

Get-Eventlog -Logname system -Source user32 | `
    Where {$_.TimeGenerated.DayOfWeek -ge [DayOfWeek]::Monday `
      -and $_.TimeGenerated.DayOfWeek -le [DayOfWeek]::Friday `
      -and $_.TimeGenerated.Hour -ge 6 `
      -and $_.TimeGenerated.Hour -lt 16} | `
    Select TimeGenerated, EntryType, Message

Get-Eventlog -Logname system -Source user32 | `
    Where {$_.TimeGenerated.DayOfWeek -ge [DayOfWeek]::Monday `
      -and $_.TimeGenerated.DayOfWeek -le [DayOfWeek]::Friday `
      -and $_.TimeGenerated.TimeOfDay -ge [Timespan]::Parse('06:00') `
      -and $_.TimeGenerated.TimeOfDay -le [Timespan]::Parse('16:00')} | `
    Select TimeGenerated, EntryType, Message