Need param expression for TimeGenerated with Event Collection rule

[Craig Williams]

I am running a response script for an event collection rule. So far,
I've gotten by with event params like "$Data/Params/Param[4]$" "$Data/
Params/Param[9]$" "$Data/Params/Param[13]$". Now I need to pass in the
Event Time as a parameter and cannot find it.

Kevin's post that I've used before doesn't include anything for this:
http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx

I've tried MANY variations trying to find something that works, but
these all fail with the 21409 "some data items could not be resolved"
error.

$Data/Context/DataItem/DataItemCreateTime$
$Data/TimeRaised$
$Data/Context/TimeAdded$
$Data/Context/DataItem/TimeAdded$
$Data/TimeGenerated$
$Data/Context/TimeGenerated$
$Data/Context/DataItem/TimeGenerated$

I miss the days when MS provided enough doc to make their products
work!
Does anyone know the expression for event time? Or a doc that
describes these?
Thanks

[Joel]

Post by Craig Williams
I am running a response script for an event collection rule. So far,
I've gotten by with event params like "$Data/Params/Param[4]$" "$Data/
Params/Param[9]$" "$Data/Params/Param[13]$". Now I need to pass in the
Event Time as a parameter and cannot find it.
Kevin's post that I've used before doesn't include anything for this:http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom...
I've tried MANY variations trying to find something that works, but
these all fail with the 21409 "some data items could not be resolved"
error.
$Data/Context/DataItem/DataItemCreateTime$
$Data/TimeRaised$
$Data/Context/TimeAdded$
$Data/Context/DataItem/TimeAdded$
$Data/TimeGenerated$
$Data/Context/TimeGenerated$
$Data/Context/DataItem/TimeGenerated$
I miss the days when MS provided enough doc to make their products
work!
Does anyone know the expression for event time? Or a doc that
describes these?
Thanks

Every data item has an attribute with the time generated - its not a
separate node. I can't remember the exact name at the moment

<dataitem timegenerated="...">
<field></field>
</dataitem>

I think you have to use the "@" syntax to get at it