Powershell is fun and yet there are times it can be annoying.
I am doing a refresh as I am looking for a new job. My last one was not script minded.
A simply test was to get use get-eventlog sort by index and time. It did this. Next was to output index, time and source.
get-eventlog -logname Security -newest 50 |select-object -property index,time,source | sort time,index | out-file c:\last.txt
The other two worked. Time did not.
You would think it would be obvious to simply use “time” and well; it isn’t.
You need to use timegenerated or timewritten.
get-eventlog -logname Application -newest 50 |select-object -property index,timegenerated,source | sort index,time
More reading to do.
techdork 