What I want to do is this:
I would like to create a analysis report for collect TrendMicro VirusScheduleScanDateTime if computer doesn’t run virus scan over 14 days.
Convert the value of VirusScheduleScanDateTime from the string to time
Get the difference between last scan date & time and the current date if > 14*day
When I try to convert string to time, it return the below results. Any idea or solution for the below result? Thanksss.
q: (value “VirusScheduleScanDateTime” of key “HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.” of registry as string)
A: 2018/03/30 12:58:46
T: 0.149 ms
q: (value “VirusScheduleScanDateTime” of key “HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.” of registry as time)
E: Singular expression refers to nonexistent object.
“2018/03/30 12:58:46” as time doesn’t work since there a lot of different time formats and nuances between them. Relevance language doesn’t make any attempt to guess at them. It has its own format, you can do “Q: now” to see it.
Here’s a rough attempt at parsing the string value into a “time” object. I’m assuming that the format stays the same across computers (YYYY/MM/DD HH:DD:SS).
q: (substring (8,2) of it as day_of_month & substring (5,2) of it as integer as month & first 4 of it as year & last 8 of it as local zoned time_of_day) of (“2018/03/30 12:58:46”)
A: Fri, 30 Mar 2018 12:58:46 +0000
T: 0.166 ms
I: singular time
After this you can use something like:
// get time two weeks after the scan date
q: [time object above] + (2 * week)
// see if the present time is after two weeks after the scan date
q: now > ([time object above] + (2 * week))
// combine together
q: now > ((substring (8,2) of it as day_of_month & substring (5,2) of it as integer as month & first 4 of it as year & last 8 of it as local zoned time_of_day) of (“2018/03/30 12:58:46”) + (2 * week))
Of course you’ll need to replace the time string above with the value of the registry key.