(imported topic written by pmullins91)
Hello,
I had a need to check some PCs to see if a certain process was running and if so, for how long. So, after some trial and error I assembled this mess to convert the process’ CreationDate in WMI and get the difference between that and ‘now.’ Maybe it will be helpful to someone else. This assumes there is only one instance of the process and that the client knows what time zone it’s in (I think). Running it with multiple copies of the .exe in memory seems to return the oldest, but I wouldn’t trust that.
If there’s an easier way of doing this I’m all ears!
q: now - ((((((last 2 of it & " " & (month (first 2 of it of last 4 of it of it as integer) as three letters) & " " & first 4 of it) of first 8 of it) as date as string) & " " & (concatenation ":" of (first 2 of it; first 2 of last 4 of it; last 2 of it) of (preceding text of first "." of following text of first 8 of it))) of string value of selects "CreationDate from Win32_Process where Caption = 'besclient.exe'" of wmi) as windows display time)
A: 2 days, 15:19:26
T: 18.743 ms
I: singular time interval