xml - How to filter from xml to get boot duration using powershell?

Question

so here is code and it gives a table as an output.

$bootevents = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Diagnostics-Performance/Operational"; id=100} $bootevent = [xml]$bootevents[0].ToXml() $bootevent.Event.EventData.Data

If I want one entity record from Name like BootTime to be filtered and output instead of whole list/table being displayed,

what changes should be made?

Else could you advise any other way to get just boot duration using powershell?

thanks in advance,

Answer 1

要获得启动时间：

$bootevent.Event.EventData.Data | ? name -eq boottime

Name     #text
----     -----
BootTime 30234

顺便说一句，较新的 powershell (6, 7) 可以过滤命名的 eventdata 数据字段。有些过滤器可以使用通配符。但是日志名有 256 个元素的限制。

Get-WinEvent @{logname='*Diagnostics-Performance*'; boottime=30234}


   ProviderName: Microsoft-Windows-Diagnostics-Performance

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
4/12/2020 1:11:05 PM           100 Warning          Windows has started up: …

Answer 2

另一个更短的选项：

$bootevent.SelectSingleNode("//*[@Name='BootTime']")

输出：

Name     #text 
----     ----- 
BootTime 123355