---

Get-WinEvent -FilterHashtable @{
    LogName='Application'
    Id=1000,1001
    StartTime=(Get-Date).AddHours(-6)
} -ErrorAction SilentlyContinue |
Select-Object TimeCreated,Id,ProviderName,
    @{N='Data';E={$_.Properties.Value -join ' | '}} |
Where-Object { $_.Data -match 'swagent|vipnet|infotecs' } |
Format-List