Why am I getting this error

[JRJohnson]

I do not understand why I am getting an error when I execute the following:

gwmi win32_ntlogevent -filter "logfile='system' and (EventCode='20158' or
EventCode='20159')"`
|select EventCode,@{name="Date";
expression={$_.timegenerated.tostring("yyyy/MM/dd")}} -first 25

I get the following error:

Select-Object : Cannot convert argument "0", with value: "yyyy/MM/dd", for
"ToString" to type "System.IFormatProvider": "Cannot convert value
"yyyy/MM/dd" to type "System.IFormatProvider". Error: "Invalid cast from
'System.String' to 'System.IFormatProvider'.""

James Johnson

[alexandair]

> expression={$_.timegenerated.tostring("yyyy/MM/dd")}} -first 25

> Select-Object : Cannot convert argument "0", with value: "yyyy/MM/dd", for

> "ToString" to type "System.IFormatProvider": "Cannot convert value
> "yyyy/MM/dd" to type "System.IFormatProvider". Error: "Invalid cast from
> 'System.String' to 'System.IFormatProvider'.""

Maybe this could help:

expression={"{0:yyyy/MM/dd}" -f
(([Management.ManagementDateTimeConverter]::toDateTime($_.timegenerated)))}

First we use ManagementDateTimeConverter.ToDateTime method to convert
a given DMTF datetime to DateTime. The returned DateTime will be in
the current time zone of the system. Then we use the PowerShell format
operator to format it.

-aleksandar
http://powershellers.blogspot.com

[Shay Levy [MVP]]

Hi JRJohnson,

timegenerated is just a string. You need to use WMI date methods to format
the date:

PS 7> [wmi]"" | gm

TypeName: System.Management.ManagementObject#\

Name MemberType Definition
---- ---------- ----------
...
ConvertFromDateTime ScriptMethod System.Object ConvertFromDateTime();
ConvertToDateTime ScriptMethod System.Object ConvertToDateTime();

So with the above you can do:

PS > $wmi = [wmi]""
PS > gwmi win32_ntlogevent -filter "logfile='system' and EventCode=20158
or EventCode=20159" | select EventCode,@{n="Date";e={$wmi.convertToDateTime($_.timegenerated).toString("yyyy/MM/dd")}}
-first 25

---
Shay Levy
Windows PowerShell MVP
http://blogs.microsoft.co.il/blogs/ScriptFanatic

J> I do not understand why I am getting an error when I execute the
J> following:
J>
J> gwmi win32_ntlogevent -filter "logfile='system' and
J> (EventCode='20158' or
J> EventCode='20159')"`
J> |select EventCode,@{name="Date";
J> expression={$_.timegenerated.tostring("yyyy/MM/dd")}} -first 25
J> I get the following error:
J>
J> Select-Object : Cannot convert argument "0", with value:
J> "yyyy/MM/dd", for "ToString" to type "System.IFormatProvider":
J> "Cannot convert value "yyyy/MM/dd" to type "System.IFormatProvider".
J> Error: "Invalid cast from 'System.String' to
J> 'System.IFormatProvider'.""
J>
J> James Johnson
J>