PowerShell function to convert WMI Event Log date and time to datetime data type

PowerShell likes to hold dates and times as the DateTime data type. This enables you to do useful things with it such as maths, easily pick out bits of it (e.g. just the date ignoring the time, just the hour, etc.) and view it in a variety of different formats.

If you pull events from the Windows Event Log via Get-WmiObject you get dates/times in a different format, such as:

20140721092203.000000+060

Which won’t directly convert to a PowerShell DateTime.

So I wrote this function, which will do it for you.

function Convert-WMIDateTime($WMIDateTime){
    # WMI Event Log DateTime format is 20150625134302.000000+060 where the +060 is the time zone (BST in this case)
    $DateTimeArray = $WMIDateTime -split "\."
    $DateTimeOnly = $DateTimeArray[0] # This is the bit before the "."
    if($DateTimeArray[1] -like "*+*"){ # Is the time zone plus or minus
        $TimeZoneSymbol = "+"
    }else{
        $TimeZoneSymbol = "-"
    }
    # Split out the time zone from the zeros and convert from minutes to hours
    $WMISummerTime = ($DateTimeArray[1] -split "\$TimeZoneSymbol")[1] / 60
    # Build the formatted date/time string up ready for conversion to a datetime variable
    $FormattedDateTime = ($DateTimeOnly + $TimeZoneSymbol + $WMISummerTime)
    [datetime]::ParseExact($FormattedDateTime,"yyyyMMddHHmmssz",[System.Globalization.CultureInfo]::InvariantCulture)
}

Just pass it a WMI-formatted date/time and it’ll return a PowerShell DateTime variable. It takes account of the time zone/daylight saving information that WMI uses.

This entry was posted in PowerShell and tagged , , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s