PowerShell Event Log Query Builder
Build a Get-WinEvent filter for an event ID, log, level and time window, then copy the command or the XML query.
Why not just open Event Viewer
Filtering in the GUI is fine for one event. The moment you need to compare a week of 4625s, or hand the query to a colleague, a command is faster and repeatable.
FilterHashtable or XML
Get-WinEvent -FilterHashtable is readable and covers the common cases: log name, event ID, level, provider, time window. It cannot express every condition.
-FilterXml accepts the full event query language, including and/or combinations that the hashtable cannot express. The builder emits both.
Two gotchas
Time is in UTC in the XML, local in the hashtable. StartTime=(Get-Date).AddHours(-24) uses local time. timediff(@SystemTime) in the XML query is relative, so it behaves the same.
Security log needs elevation. Reading Security requires an administrator token; otherwise Get-WinEvent returns access denied and the event looks missing.