so here is code and it gives a table as an output.
$bootevents = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Diagnostics-Performance/Operational"; id=100}
$bootevent = [xml]$bootevents[0].ToXml()
$bootevent.Event.EventData.Data
If I want one entity record from Name like BootTime to be filtered and output instead of whole list/table being displayed,
what changes should be made?
Else could you advise any other way to get just boot duration using powershell?
thanks in advance,
To just get the boottime:
By the way, newer powershells (6, 7) can filter the named eventdata data fields. And some filters can take wildcards. But there's a 256 element limit on the logname.