批处理获取电脑开关机时间的全部提取

wh123wh123

系统日志在d:\log.txt文件里，格式类似如下：请问使用批处理如何提取关键词“6005”和“6006”上面对应的时间？并且逐行回显和导出到文本DD.txt里，例如:
开机2021-02-23T16:44:42.139 ----关机2021-02-23T21:41:35.000
......

d:\log.txt内容：
......
Event[163]:
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2021-02-22T16:44:41.702
  Event ID: 7002
  Task: N/A
  Level: 信息
  Opcode: 信息
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 555555
  Description:
客户体验改善计划的用户注销通知

Event[164]:
  Log Name: System
  Source: EventLog
  Date: 2021-02-22T16:44:42.000
  Event ID: 6006
  Task: N/A
  Level: 信息
  Opcode: N/A
  Keyword: 经典
  User: N/A
  User Name: N/A
  Computer: 555555
  Description:
事件日志服务已停止。

Event[153]:
  Log Name: System
  Source: EventLog
  Date: 2021-02-22T21:41:35.000
  Event ID: 6005
  Task: N/A
  Level: 信息
  Opcode: N/A
  Keyword: 经典
  User: N/A
  User Name: N/A
  Computer: 555555
  Description:
事件日志服务已启动。

Event[154]:
.....

qixiaobin0715

1. @echo off
   
2. setlocal enabledelayedexpansion
   
3. (for /f "delims=" %%a in ('findstr  "Date: ID:" d:\log.txt') do (
   
4.     set "str1=%%a"
   
5.     if not "!str1:6006=!"=="!str1!" (
   
6.         set "var=开机!str2!
   
7.     ) else if not "!str1:6005=!"=="!str1!" (
   
8.         echo !var! ----关机!str2!
   
9.     )
   
10.     set "str2=%%a"
    
11.     set "str2=!str2:*Date=!"
    
12. ))>d:\DD.txt
    
13. pause

复制代码

wh123wh123

回复 2# qixiaobin0715

您好，老师，为什么dos窗口不显示出来？另外6005是开机6006是关机吧？我修改为

    @echo off
setlocal enabledelayedexpansion
(for /f "delims=" %%a in ('findstr  "Date: ID:" d:\log.txt') do (
    set "str1=%%a"
    if not "!str1:6005=!"=="!str1!" (
        set "var=本次开机!str2!
    ) else if not "!str1:6006=!"=="!str1!" (
        echo !var! ----上次关机!str2!
    )
    set "str2=%%a"
    set "str2=!str2:*Date=!"
))>d:\DD.txt
pause，不显示出来咋办呢
能不能按这样的格式处理？
开机----
开机----关机
....
感觉这样才合理，因为每次的开机时间都比关机时间早

wh123wh123

::提取日志全部开关机记录
(for /f "delims=" %%a in ('findstr  "Date: ID:" d:\log.txt') do (
    set "str1=%%a"
    if not "!str1:6006=!"=="!str1!" (
        set "var=关机!str2!
    ) else if not "!str1:6005=!"=="!str1!" (
        echo 开机!str2! ---- !var!
    )
    set "str2=%%a"
    set "str2=!str2:*Date=!"
))>d:\DD.txt
for /f "tokens=* delims=" %%a in (d:\DD.txt) do echo %%a
::start d:\DD.txt
pause
这样为什么输出到d:\DD.txt里内容会多出来无用字符2611？本来是
开机: 2021-02-24T11:21:52.000 ----
开机: 2021-02-23T21:41:35.000 ---- 关机: 2021-02-24T03:14:50.000
开机: 2021-02-23T12:54:34.000 ---- 关机: 2021-02-23T16:44:42.000

可是输出却是
开机: 2021-02-24T11:21:52.000 ---- 2611
开机: 2021-02-23T21:41:35.000 ---- 关机: 2021-02-24T03:14:50.000
开机: 2021-02-23T12:54:34.000 ---- 关机: 2021-02-23T16:44:42.000