Converting between XML systemtime and number of hours or days with Powershell

By Tom Kitching

I recently used an XML query in Powershell that looked like this: [cc lang=”xml” escaped=”true”]$xmlQuery = @’ <QueryList> <Query Id=”0″ Path=”Security”> <Select Path=”Security”> *[System[(EventID=4624) and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name=’IPAddress’] and (Data=’192.168.11.7′)]] </Select> </Query> /QueryList>…