pull event timestamps from windows event logging