{"id":17541,"date":"2010-08-04T00:01:00","date_gmt":"2010-08-04T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/08\/04\/manipulating-date-ranges-with-windows-powershell\/"},"modified":"2010-08-04T00:01:00","modified_gmt":"2010-08-04T00:01:00","slug":"manipulating-date-ranges-with-windows-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/manipulating-date-ranges-with-windows-powershell\/","title":{"rendered":"Manipulating Date Ranges with Windows PowerShell"},"content":{"rendered":"

 \n\"Hey,\nHey, Scripting Guy! I need to be able to add and subtract dates so that I can use the results in custom queries for various Windows event logs using Windows PowerShell<\/a>. Is doing this type of date manipulation easy or hard to do with Windows PowerShell? If it is not too difficult to do, could you whip up some examples of searching date ranges?\n— SH\n\"Hey,\nHello SH,\nMicrosoft Scripting Guy Ed Wilson here. One of the things I used to hate about writing VBScript code was working with dates. It is not that it was difficult, but it did seem a bit arcane. There must have been almost 20 different functions involved in date creation, parsing, and manipulation. Maybe not quite that many, but it seemed<\/i> so. To make matters worse, I began to develop an aversion to parsing dates, and as a result I would do strange things to avoid parsing dates, which in turn made it more difficult (due to lack of familiarity) when I had to parse a date. So the vicious circle continued to wobble out of control until one day I forced myself to spend a day writing nothing but date manipulation code.\nLuckily, date parsing and manipulation in Windows PowerShell is much easier. However, you won’t know it is easier until you sit down and spend some time working with the system.datetime<\/a> .NET Framework object. Why, you may ask, do I refer to the system.datetime<\/b> .NET Framework object when just a minute ago I was talking about dates? Because a date in Windows PowerShell is an instance of a datetime<\/b> (you can leave the word “system” off if you wish) object. You can use the Get-Member<\/b> cmdlet to see what type of object you are working with. The Get-Date<\/b> cmdlet returns the current date and time. When the current date and time are piped to the Get-Member<\/b> cmdlet, the members of a System.DateTime<\/b> .NET Framework class are displayed. This is shown here:<\/p>\n

PS C:> Get-Date<\/p>\n

Monday, August 02, 2010 10:38:36 AM<\/p>\n

PS C:> Get-Date | Get-Member<\/p>\n

   <\/span>TypeName: System.DateTime<\/p>\n

Name                 <\/span>MemberType     <\/span>Definition
—-                 <\/span>———-     <\/span>———-
Add                 <\/span> <\/span>Method         <\/span>System.DateTime Add(System.TimeSpan value)
AddDays              <\/span>Method         <\/span>System.DateTime AddDays(double value)
AddHours             <\/span>Method         <\/span>System.DateTime AddHours(double value)
AddMilliseconds      <\/span>Method         <\/span>System.DateTime AddMilliseconds(double value)
AddMinutes           <\/span>Method         <\/span>System.DateTime AddMinutes(double value)
AddMonths            <\/span>Method         <\/span>System.DateTime AddMonths(int months)
AddSeconds           <\/span>Method         <\/span>System.DateTime AddSeconds(double value)
AddTicks             <\/span>Method         <\/span>System.DateTime AddTicks(long value)
AddYears             <\/span>Method         <\/span>System.DateTime AddYears(int value)
CompareTo            <\/span>Method         <\/span>int CompareTo(System.Object value), int Compa…
Equals              <\/span> <\/span>Method         <\/span>bool Equals(System.Object value), bool Equals…
GetDateTimeFormats   <\/span>Method         <\/span>string[] GetDateTimeFormats(), string[] GetDa…
GetHashCode          <\/span>Method         <\/span>int GetHashCode()
GetType              <\/span>Method         <\/span>type GetType()
GetTypeCode          <\/span>Method         <\/span>System.TypeCode GetTypeCode()
IsDaylightSavingTime Method         <\/span>bool IsDaylightSavingTime()
Subtract             <\/span>Method         <\/span>System.TimeSpan Subtract(System.DateTime valu…
ToBinary             <\/span>Method         <\/span>long ToBinary()
ToFileTime           <\/span>Method         <\/span>long ToFileTime()
ToFileTimeUtc        <\/span>Method         <\/span>long ToFileTimeUtc()
ToLocalTime          <\/span>Method         <\/span>System.DateTime ToLocalTime()
ToLongDateString     <\/span>Method         <\/span>string ToLongDateString()
ToLongTimeString     <\/span>Method         <\/span>string ToLongTimeString()
ToOADate             <\/span>Method         <\/span>double ToOADate()
ToShortDateString    <\/span>Method         <\/span>string ToShortDateString()
ToShortTimeString    <\/span>Method         <\/span>string ToShortTimeString()
ToString             <\/span>Method         <\/span>string ToString(), string ToString(string for…
ToUniversalTime      <\/span>Method         <\/span>System.DateTime ToUniversalTime()
DisplayHint          <\/span>NoteProperty   <\/span>Microsoft.PowerShell.Commands.DisplayHintType…
Date                 <\/span>Property       <\/span>System.DateTime Date {get;}
Day                  <\/span>Property     &nbsp\n; <\/span>System.Int32 Day {get;}
DayOfWeek            <\/span>Property       <\/span>System.DayOfWeek DayOfWeek {get;}
DayOfYear            <\/span>Property       <\/span>System.Int32 DayOfYear {get;}
Hour                 <\/span>Property    <\/span>   <\/span>System.Int32 Hour {get;}
Kind                 <\/span>Property       <\/span>System.DateTimeKind Kind {get;}
Millisecond          <\/span>Property       <\/span>System.Int32 Millisecond {get;}
Minute               <\/span>Property       <\/span>System.Int32 Minute {get;}
Month                <\/span>Property       <\/span>System.Int32 Month {get;}
Second               <\/span>Property       <\/span>System.Int32 Second {get;}
Ticks                <\/span>Property       <\/span>System.Int64 Ticks {get;}
TimeOfDay            <\/span>Property       <\/span>System.TimeSpan TimeOfDay {get;}
Year                 <\/span>Property       <\/span>System.Int32 Year {get;}
DateTime             <\/span>ScriptProperty System.Object DateTime {get=if ((& { Set-Stri…<\/p>\n

PS C:><\/p>\n

<\/span><\/span>\nThe members, methods, and properties of the System.DateTime<\/b> .NET Framework class that are displayed are instance methods and properties. This means that they work on an instance of the class. Normally, an instance of a class is created when one uses a constructor. Constructors are detailed on MSDN. For example, the constructor for the System.DateTime class<\/a> indicates that you can use a number of different ways to create an instance of the class. One constructor will accept three integers for input. However, when I supply the month, day, and year, an error arises. A closer look at the constructor indicates that the constructor wants year, month, and day. When this is supplied, a new instance of a system.datetime<\/b> object is created. Because no time value was supplied to the constructor, the time is set to midnight. Here the New-Object<\/b> cmdlet is used to create an instance of a system.datetime<\/b> object:\nPS<\/span> <\/span>C:><\/span> <\/span>$dte<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span>system.datetime(<\/span>8<\/span>,<\/span>1<\/span>,<\/span>2010<\/span>)<\/span>
<\/span>New-Object<\/span> <\/span>:<\/span> <\/span>Exception<\/span> <\/span>calling<\/span> “.ctor” <\/span>with<\/span> “3” <\/span>argument(s):<\/span> “Year, Month, and Day p
arameters describe an unrepresentable DateTime.”
<\/span>At<\/span> <\/span>line:<\/span>1<\/span> <\/span>char:<\/span>18<\/span>
<\/span>+<\/span> <\/span>$dte<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span><<<<<\/span> <\/span>system.datetime(<\/span>8<\/span>,<\/span>1<\/span>,<\/span>2010<\/span>)<\/span>
<\/span>+<\/span> <\/span>CategoryInfo<\/span> <\/span>:<\/span> <\/span>InvalidOperation:<\/span> <\/span>(:)<\/span> <\/span>[<\/span>New-Object<\/span>],<\/span> <\/span>MethodInvocationE<\/span>
<\/span>xception<\/span>
<\/span>+<\/span> <\/span>FullyQualifiedErrorId<\/span> <\/span>:<\/span> <\/span>ConstructorInvokedThrowException,Microsoft.PowerShell<\/span>
<\/span>.Commands.NewObjectCommand<\/span>
<\/span>PS<\/span> <\/span>C:><\/span> <\/span>$dte<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span>system.datetime(<\/span>2010<\/span>,<\/span>8<\/span>,<\/span>1<\/span>)<\/span>
<\/span>PS<\/span> <\/span>C:><\/span> <\/span>$dte<\/span>
<\/span>Sunday,<\/span> <\/span>August<\/span> <\/span>01<\/span>,<\/span> <\/span>2010<\/span> <\/span>12<\/span>:<\/span>00<\/span>:<\/span>00<\/span> <\/span>AM<\/span>
<\/span>PS<\/span> <\/span>C:><\/span>\nNow<\/b> and today<\/b> are both static properties from the system.datetime<\/b> .NET Framework class that return instances of the class. To call a static property, place the class name inside square brackets, use two colons, and then add the property name. To prove that it is a datetime<\/b> object that is returned, use the gettype method<\/a> that is always available from any system.object<\/b>. This is shown here:<\/p>\n

PS C:> [datetime]::now<\/p>\n

Monday, August 02, 2010 10:48:39 AM<\/p>\n

PS C:> ([datetime]::now).gettype()<\/p>\n

IsPublic IsSerial Name     <\/span>                                <\/span>BaseType
——– ——– —-                                     <\/span>——–
True     <\/span>True     <\/span>DateTime                                 <\/span>System.ValueType<\/p>\n

PS C:> [datetime]::today<\/p>\n

Monday, August 02, 2010 12:00:00 AM<\/p>\n

PS C:> ([datetime]::today).gettype()<\/p>\n

IsPublic IsSerial Name                                     <\/span>BaseType
——– ——– —-                                     <\/span>——–
True     <\/span>True     <\/span>DateTime                                 <\/span>System.ValueType<\/p>\n

PS C:><\/p>\n

<\/span><\/span>\nInterestingly enough, the datetime<\/b> object that is returned via the Get-Date<\/b> cmdlet is the same object that is returned by the static now<\/b> property from the datetime<\/b> class. Use of one or the other is a matter of preference. I generally use the Get-Date<\/b> cmdlet because it is easier to type. Each methodology is illustrated here:\nPS<\/span> <\/span>C:><\/span> <\/span>[datetime]::now<\/span>
<\/span>Monday,<\/span> <\/span>August<\/span> <\/span>02<\/span>,<\/span> <\/span>2010<\/span> <\/span>10<\/span>:<\/span>51<\/span>:<\/span>32<\/span> <\/span>AM<\/span>
<\/span>PS<\/span> <\/span>C:><\/span> <\/span>Get-Date<\/span>
<\/span>Monday,<\/span> <\/span>August<\/span> <\/span>02<\/span>,<\/span> <\/span>2010<\/span> <\/span>10<\/span>:<\/span>51<\/span>:<\/span>35<\/span> <\/span>AM<\/span>
<\/span>PS<\/span> <\/span>C:><\/span>\nAfter you have a datetime<\/b> object, you can use the methods that are exposed by that object. For example, you can easily use one of the various methods to add minutes, hours, days, months, years, etc., to the current date to create a new date in the future or in the past (if you pass a negative number):<\/p>\n

PS C:> $dte = Get-Date
PS C:> $dte | Get-Member -MemberType method add*<\/p>\n

   <\/span>TypeName: System.DateTime<\/p>\n

Name            <\/span>MemberType Definition
—-            <\/span>———- ———-
Add             <\/span>Method     <\/span>System.DateTime Add(System.TimeSpan value)
AddDays       <\/span>  <\/span>Method     <\/span>System.DateTime AddDays(double value)
AddHours        <\/span>Method     <\/span>System.DateTime AddHours(double value)
AddMilliseconds Method     <\/span>System.DateTime AddMilliseconds(double value)
AddMinutes      <\/span>Method     <\/span>System.DateTime AddMinutes(double value)
AddMonths       <\/span>Method     <\/span>System.DateTime AddMonths(int months)
AddSeconds      <\/span>Method     <\/span>System.DateTime AddSeconds(double value)
AddTicks        <\/span>Method     <\/span>System.DateTime AddTicks(long value)
AddYears        <\/span>Method     <\/span>System.DateTime AddYears(int value)<\/p>\n

PS C:> $dte<\/p>\n

Monday, August 02, 2010 10:58:58 AM<\/p>\n

PS C:> $dte.AddDays(1)<\/p>\n

Tuesday, August 03, 2010 10:58:58 AM<\/p>\n

PS C:> $dte.AddDays(-1)<\/p>\n

Sunday, August 01, 2010 10:58:58 AM<\/p>\n

PS C:> $dte.AddHours(8)<\/p>\n

Monday, August 02, 2010 6:58:58 PM<\/p>\n

PS C:> $dte.AddHours(-8)<\/p>\n

Monday, August 02, 2010 2:58:58 AM<\/p>\n

PS C:><\/p>\n

<\/span><\/span>\nThis can easily be incorporated with a cmdlet such as Get-EventLog<\/b>. If I want to see event log entries from the application log that occurred in the last hour, I can use code that looks like this:<\/p>\n

PS C:> Get-EventLog -LogName application -After $dte.AddMinutes(-60)<\/p>\n

   <\/span>Index Time          <\/span>EntryType   <\/span>Source                 <\/span>InstanceID Message
   <\/span>—– —-          <\/span>———   <\/span>——                 <\/span>———- ——-
   <\/span>19016 Aug 02 10:24  <\/span>Information Office Software P…   <\/span>1073742827 The Software…
   <\/span>19015 Aug 02 10:24  <\/span>Information Office Software P…   <\/span>1073742827 The Software…
   <\/span>19014 Aug 02 10:24  <\/span>Information Office Software P…   <\/span>1073742827 The Software…
   <\/span>19013 Aug 02 10:24  <\/span>0           <\/span>Office Software P…   <\/span>1073742726 The Software…
   <\/span>19012 Aug 02 10:24  <\/span>Information Office Software P…   <\/span>1073742890 Initializati…
   <\/span>19011 Aug 02 10:24  <\/span>Information Office Software P…   <\/span>1073742724 The Software…<\/p>\n

PS C:><\/p>\n

<\/span><\/span><\/p>\n

When working with two datetime<\/b> objects, you can subtract them and a timespan<\/b> object is returned. This is shown here:<\/p>\n

PS C:> $dte = Get-Date
PS C:> $sDate = Ge<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

  Hey, Scripting Guy! I need to be able to add and subtract dates so that I can use the results in custom queries for various Windows event logs using Windows PowerShell. Is doing this type of date manipulation easy or hard to do with Windows PowerShell? If it is not too difficult to do, […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[13,3,4,45],"class_list":["post-17541","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-dates-and-times","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Hey, Scripting Guy! I need to be able to add and subtract dates so that I can use the results in custom queries for various Windows event logs using Windows PowerShell. Is doing this type of date manipulation easy or hard to do with Windows PowerShell? If it is not too difficult to do, […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17541","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=17541"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17541\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=17541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=17541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=17541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}