EventLog XML查询筛选日期范围

似乎找不到在特定日期范围内查询事件日志的正确语法

<QueryList>
  <Query Id="0" Path="Security">
        <Select Path="Security"> 
        *[EventData[Data[@Name='SubjectUserName'] and (Data='test')]] 
        and
        *[System[TimeCreated[@SystemTime'] &gt;= '2015-01-24T00:00:000Z']]
        and
        *[System[TimeCreated[@SystemTime'] &lt;= '2015-01-26T00:00:000Z']]
    </Select>
  </Query>
</QueryList>

*[EventData[Data[@Name='SubjectArchitectureName']和（Data='test'）]]
和
*[系统[创建的时间[@SystemTime']='2015-01-24T00:00:000Z']]
和
*[系统[创建的时间[@SystemTime']='2015-01-26T00:00:000Z']]

我在刚才删除的查询中看到一个额外的撇号，请在SystemTime之前尝试此操作。。它现在应该运行了

` 

   <QueryList>
  <Query Id="0" Path="Security">
        <Select Path="Security"> 
        *[EventData[Data[@Name='SubjectUserName'] and (Data='test')]] 
        and
        *[System[TimeCreated[@SystemTime] &gt;= '2015-01-24T00:00:000Z']]
        and
        *[System[TimeCreated[@SystemTime] &lt;= '2015-01-26T00:00:000Z']]
    </Select>
  </Query>
</QueryList>'

`
*[EventData[Data[@Name='SubjectArchitectureName']和（Data='test'）]]
和
*[System[TimeCreated[@SystemTime]='2015-01-24T00:00:000Z']
和
*[System[TimeCreated[@SystemTime]='2015-01-26T00:00:000Z']
'
此语法错误：
[System[TimeCreated[@SystemTime]=…


它必须是
[System[TimeCreated[@SystemTime=…

见下面我的更正

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">
    *[System[TimeCreated[@SystemTime&gt;='2017-12-28T00:00:00' and @SystemTime&lt;='2018-01-04T00:00:00']]]
    </Select>
  </Query>
</QueryList>


*[系统[创建的时间[@SystemTime='2017-12-28:00:00'和@SystemTime='2018-01-04T00:00:00']]