It's blank because there are no such thing as a Time
property. It's an alias used in the default view of Get-EventLog
.
PS > Get-EventLog -LogName System | gm
TypeName: System.Diagnostics.EventLogEntry#System/EventLog/2147489661
Name MemberType Definition
---- ---------- ----------
....
TimeGenerated Property datetime TimeGenerated {get;}
TimeWritten Property datetime TimeWritten {get;}
UserName Property string UserName {get;}
EventID ScriptProperty System.Object EventID {get=$this.get_EventID() -band 0x...
Use Format-Table TimeGenerated
to get the time when the event happend, and TimeWritten
to get the time it was saved to the log.
The column Time
in the default view is TimeGenerated
formated like {0:MMM} {0:dd} {0:HH}:{0:mm}
. You can see this in one of the format files in Powershell. For this case, it's in "C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml" :
.....
<ViewSelectedBy>
<TypeName>System.Diagnostics.EventLogEntry</TypeName>
</ViewSelectedBy>
.....
<TableColumnHeader>
<Label>Time</Label>
<Width>13</Width>
</TableColumnHeader>
.....
<TableColumnItem>
<PropertyName>TimeGenerated</PropertyName>
<FormatString>{0:MMM} {0:dd} {0:HH}:{0:mm}</FormatString>
</TableColumnItem>
.....