Need to get the latest time stamp of event logs

Hi Team,

i need to get the latest time stamp from the following relevance

preceding texts of firsts "<" of following texts of firsts ">" of following texts of lasts "BootStartTime" of ((xmls of records whose (event id of it = 100) of event log "Microsoft-Windows-Diagnostics-Performance/Operational" as xml))

This relevnace returns the

Current Selection Evaluates To:

2023-04-24T09:49:52.5960611Z
2023-04-24T11:10:34.0329153Z
2023-05-04T12:13:49.0676869Z
2023-05-04T12:19:57.1011012Z
2023-05-07T14:09:01.0992894Z
2023-05-12T13:53:21.2880669Z
2023-05-18T07:05:59.1331162Z
2023-05-19T08:44:52.0173707Z
2023-05-19T13:18:35.1286124Z
2023-05-21T18:45:43.2904269Z
2023-06-01T07:06:15.1476596Z
2023-06-13T14:09:36.1753335Z
2023-06-20T09:11:33.1661044Z
2023-06-28T12:13:11.0342433Z
2023-06-30T05:50:25.1799787Z
2023-07-08T15:49:46.2527774Z
2023-07-17T10:51:59.1464752Z
2023-07-25T14:57:31.3310463Z
2023-08-04T20:00:14.0589332Z
2023-08-15T16:06:11.3324576Z
2023-08-19T13:31:35.3324627Z
2023-09-11T17:49:30.6301777Z
2023-09-11T17:59:09.1671798Z
2023-09-12T06:26:58.0451456Z
2023-09-20T06:16:28.1534994Z
2023-10-11T07:06:09.1534176Z
2023-10-17T21:06:10.1624446Z
2023-10-26T08:00:48.4366685Z
2023-10-26T08:42:02.1355387Z
2023-11-10T06:45:50.2254638Z
2023-11-20T17:13:07.4232018Z
2023-11-30T13:25:08.0373372Z
2023-12-01T08:34:03.0389631Z
2023-12-03T10:45:45.1908815Z
2023-12-03T17:00:59.1799108Z
2023-12-08T18:53:05.2810031Z
2023-12-09T16:15:39.1951192Z
2023-12-14T10:14:40.0738981Z
2023-12-14T13:10:49.2523607Z
2023-12-14T13:23:50.2284243Z
2023-12-16T12:05:44.5629656Z
2023-12-20T07:42:47.0542744Z
2024-01-02T06:50:21.3313169Z
2024-01-15T15:00:45.1133135Z
2024-01-16T10:09:02.3236980Z
2024-01-16T13:41:16.3692194Z
2024-01-22T07:53:24.5679488Z
2024-01-24T07:53:04.3769411Z
2024-01-30T07:06:38.6011044Z
2024-01-31T13:19:22.3784695Z
2024-02-01T10:58:08.1599953Z
2024-02-01T11:11:23.3664662Z
2024-02-02T07:55:22.3527062Z
2024-02-06T10:22:14.0077788Z
2024-02-06T12:05:52.3304851Z
2024-02-06T13:21:32.3110076Z
2024-02-12T07:39:39.3597841Z
2024-02-19T09:16:48.3557118Z
2024-02-21T10:41:26.4179446Z
2024-02-24T20:05:13.4806098Z
2024-02-27T08:13:14.4261508Z
2024-02-29T07:19:24.4656912Z
2024-03-16T17:31:50.6591529Z
2024-04-05T07:02:05.7229857Z
2024-04-10T07:34:21.2801246Z
2024-04-13T11:19:23.6885626Z
2024-04-21T10:49:12.4642445Z
2024-04-21T11:14:05.2455307Z
2024-04-24T08:18:16.2221356Z
2024-04-25T10:02:39.2555242Z
2024-04-30T06:20:09.5697549Z
2024-05-08T12:56:20.6155175Z
2024-05-16T19:43:58.1598630Z
2024-05-23T10:39:45.4263001Z
2024-06-02T14:39:52.9550552Z
2024-06-10T11:30:09.6992992Z
2024-06-15T09:55:55.6178354Z
2024-06-15T12:46:21.5339346Z
2024-06-15T13:11:01.5153299Z
2024-06-24T11:48:10.3147595Z
2024-06-27T07:00:12.7333803Z
2024-07-03T06:18:09.7178686Z
2024-07-03T06:36:10.9156008Z

Evaluation time: 139.929 ms

I need the highlighted value.

Any advise on this is highly appreciated.

@brolly33 Please help here.

One method could be concatenate all values with a string delimiter then parse the following text of the last occurrence of the delimiter

following text of last "##" of concatenation "##" of (preceding texts of firsts "<" of following texts of firsts ">" of following texts of lasts "BootStartTime" of ((xmls of records whose (event id of it = 100) of event log "Microsoft-Windows-Diagnostics-Performance/Operational" as xml))) as string

Could possibly work out a method to inspect the XML using an xpath but concatention should work using your existing inspection.

4 Likes