title: PS using Get-WinEvent with FilterXPath and datetime variables?
body: <ul>
  <li>I'm grabbing a handful of events from an event log in chronological order</li>
  <li>don't want to pipe to <em>Where</em></li>
  <li>want to use <strong>get-winevent</strong></li>
  </ul>
  
  <p>After I get the Event1, I need to get the 1st instance of another event that occurs some unknown amount of time <em>after</em> Event1. then grab Event3 that occurs sometime after Event2 etc.</p>
  
  <p>Basically starting with:</p>
  
  <pre><code>$filterXML = @'
  &lt;QueryList&gt;
    &lt;Query Id="0" Path="System"&gt;
      &lt;Select Path="System"&gt;*[System[Provider[@Name='Microsoft-Windows-Kernel-General'] and (Level=4 or Level=0) and (EventID=12)]]&lt;/Select&gt;
    &lt;/Query&gt;
  &lt;/QueryList&gt;
  '@    
  $event1=(Get-WinEvent -ComputerName $PCname -MaxEvents 1 -FilterXml $filterXML).timecreated
  </code></pre>
  
  <p>Give me the datetime of Event1.
  Then I want to do something like:</p>
  
  <p>Get-WinEvent -LogName "System" -MaxEvents 1 -FilterXPath "*[EventData[Data = 'Windows Management Instrumentation' and <strong>TimeCreated -gt $event1</strong>]]"</p>
  
  <p>Obviously the timecreated part bolded there doesn't work but I hope you get what I'm trying to do. any help?</p>
  
  <hr>
  
  <p>I think perhaps filterhashtable is how I need to go? looking for clarification:</p>
  
  <pre><code>$Event2=(Get-WinEvent -Oldest -MaxEvents 1 -FilterHashtable @{logname="system"; providername="Microsoft-Windows-GroupPolicy"; starttime=$Event1}).TimeCreated
  </code></pre>