title: How to use Eventlog and query?
body: <p>I'm trying to use <code>ExportLog()</code> for getting specified date eventlog. The following code works fine:</p>
  
  
  
  <pre class="lang-bsh prettyprint-override"><code>$Filter = "*[System[TimeCreated[@SystemTime&gt;='2016-01-29T15:00:00.000Z' and @SystemTime&lt;='22016-01-30T14:59:59.999Z']]]"
  for ( $i = 0 ;$i -lt  $LogName.count; $i++ ) {
      $OutFileName = $LogName[$i] + "_" + $LogDate + ".evtx"
      $OutFolders  = $OutFolder + "\" + $LogName[$i]
      $OutFile     = $OutFolders + "\" + $OutFileName
  
      Write-Output $OutFile
  
      if ((Test-Path $OutFolders) -eq $false){
          New-Item -Path $OutFolders -Type directory
      }
      if ((Test-Path $OutFile) -eq $true){
          Remove-Item $OutFile
      }
  
      $evsession = New-Object -TypeName System.Diagnostics.Eventing.Reader.EventLogSession
      $evsession.ExportLog($LogName[$i], "LogName", $Filter, $OutFile)
  </code></pre>
  
  <p>but this did not work as I expected:</p>
  
  <pre class="lang-bsh prettyprint-override"><code>$LogDate   = (Get-Date).AddDays($fromDay).ToString("yyyyMMdd")
  $StartTime =
    [DateTime] (Get-Date).AddDays($fromDay).ToString("yyyy/MM/dd 00:00:00")
  
  $EndUtcTime1   
    [DateTime] (Get-Date).AddDays($fromDay).ToString("yyyy/MM/dd 23:59:59")
  
  $Filter = "*[System[TimeCreated[@SystemTime&gt;= '$StartTime' and @SystemTime&lt;= '$EndUtcTime' ]]]"
  
  # after this it's the same as the above code snippet
  </code></pre>
  
  <p>Does anynone know the reason why it does not work correctly?</p>