This is my third update to this script.  I think this script will finally push me into "programming like a real man" (e.g. with functions, params, hash arrays, throws, traps other optimizations) e.g. http://rmfdevelopment.com/PowerShell_Scripts/QueryEventFunction.ps1

Interestingly, I found System Event ID 36 breaks my script. It is a failure of the Windows Time Service and I think I have found a defect in Time/Date formatting:

## Takes Event Log queries...and finds elapsed time from event

# Default queries localhost system shutdown (EventID 6009)

# E.G. .\EventLogQueries.ps1 System 4072

# E.G .  6005..6009 | %{.\EventLogQueries.ps1 System $_ }    

if ($args[0] -eq $Null) {$Log_Type = "System"} else {$Log_Type = $args[0]}

if ($args[1] -eq $Null) {$Event_ID = 6009} else {$Event_ID = $args[1]}

write $args[1]

## TODO for remote and other properties:

## if ($args[3] = $Null) {$Computer = localhost} else {$args[3] = $Computer}

# query Event Log

$EventLog = get-eventlog -log $Log_Type | Select Message,EventID,TimeGenerated

$Event = $EventLog | ?{$_.eventID -eq $Event_ID}

$EventID = $Event | %{$_.eventID}

$Message = $Event | %{$_.Message}

$TimeGenerated = $Event | %{$_.TimeGenerated}

 

## TODO: Needs Trap or Throw for bad date or time format from Microsoft like for Event ID 36

## EventID 36 will break this script because....(??) 

## if EventID is null, discard query

if  ($LogType = "System" -and $EventID -eq 36) {$EventID = $NULL;write "Skip System EventID 36 because it breaks this script"}

if  ($EventID -ne $NULL)

{

    # Find elapsed time, total restarts, restarts/days and generate some arrays

    ## DBG::$test_EventID = $EventID[0]

    ## DBG::$test_Args_1  = $Args[1]

    ## DBG::write "Args[1]:$test_Args_1 -- Date/Time -- Elapsed Time (D.H.M.S)"

    

    write  "EventID -- Message -- Date/Time -- Elapsed Time (D.H.M.S)"

    $array_count = ($Event).count - 1

    $total_events = ($Event).count

    $curr_date = get-date

    $first_event_date = $TimeGenerated[$array_count]

    $last_event_date = $TimeGenerated[0]

    $event_time_span =($curr_date - $first_event_date)  

    $elapsed = $TimeGenerated[0..$array_count] | %{($curr_date - $_)}

    $AverageDaysBetweenEvents = $event_time_span.Days%$total_events

    

    

    ## Report Data

    ## What happens if data field is null?

    0..$array_count | %{

    $days = $elapsed[$_].days;

    $hours = $elapsed[$_].hours;

    $minutes = $elapsed[$_].minutes;

    $seconds = $elapsed[$_].seconds;

    $EventIDPrint = $EventID[$_];

    $MessagePrint = $Message[$_];

    $TimeGeneratedPrint = $TimeGenerated[$_];

    write "$EventIDPrint,$MessagePrint,$TimeGeneratedPrint,$days.$hours.$minutes.$seconds" }

    }

    

if  ($EventID -ne $NULL)

{ 

write "Number of Events:$total_events First Occurrence:$first_event_date Last Occurrence:$last_event_date Average Days Between Events:$AverageDaysBetweenEvents"

}