title: Using Powershell to Filter Event Logs for Both Day and Time
body: <p>I am trying to use Powershell to pull system event logs for a specific set of event IDs (including shutdown and start events) for the past week while excluding a specific window of time each day which is used for scheduled reboots (and therefore are not going to be relevant shutdown and start events for the data I am trying to collect).</p>
  
  <p>I can filter the events for the past 7 days:</p>
  
  <pre><code>$fileDate = Get-Date -UFormat "%Y-%m-%d"
  $logDate = (Get-Date).AddDays(-7)
  Foreach ($Computer in $C) 
      {
      $Computer;
      Get-WinEvent -Computername $Computer -FilterHashtable @{logname='System'; id=12,13,27,33; StartTime=$logDate} | Format-Table -AutoSize -Wrap | Out-String -Width 4096 &gt; "$env:userprofile\Desktop\$env:computername-$fileDate.txt"
      }
  </code></pre>
  
  <p>This will include all events for those 7 days, including the ones associated with the reboot window each day, which I do not want.</p>
  
  <p>I can filter the events to exclude my specified time window:</p>
  
  <pre><code>$fileDate = Get-Date -UFormat "%Y-%m-%d"
  Foreach ($Computer in $C) 
      {
      $Computer;
      Get-WinEvent -Computername $Computer -FilterHashtable @{logname='System'; id=12,13,27,33; StartTime="00:00"; EndTime="04:00"} | Format-Table -AutoSize -Wrap | Out-String -Width 4096 &gt; "$env:userprofile\Desktop\$env:computername-$fileDate.txt"
      Get-WinEvent -Computername $Computer -FilterHashtable @{logname='System'; id=12,13,27,33; StartTime="05:00"; EndTime="23:59"} | Format-Table -AutoSize -Wrap | Out-String -Width 4096 &gt;&gt; "$env:userprofile\Desktop\$env:computername-$fileDate.txt"
      }
  </code></pre>
  
  <p>This will filter out the hour window I don't want to see events for, but will only capture events for the current day.</p>
  
  <p>I have not figured out a good way to combine these two in order to pull 7 days' worth of logs while excluding the 1 hour window I want ignored.  I searched around but couldn't find something indicating exactly what I was looking for.  If I missed it in my searches, please point me in the right direction.</p>