How do I filter procmon results on time-of-day?

Question

Filtering procmon results on time-of-day does not work as one would expect. Suppose the results show a line with time-of-day "7:44:26.4065994 AM".

• If you filter on 'Time of Day' begins with '7:44:26', all results are filtered out.
• If you filter on 'Time of Day' contains '7:44:26', you get the expected results.
• If you try to filter more precisely, specifying contains '7:44:26.40', all the results are filtered out.

Unlike the other procmon fields, which are uniformly treated as strings, the time-of-day field is not, apparently. There may be some way to filter precisely, but it's not obvious.

Ringler

Answer 1

You can select a range of lines from the procmon listing and then, by right clicking, you can exclude lines before or after that range. This exclusion is based on date and time.

This has the desired effect. In addition you can look at the filter and see how this effect is achieved.

Ringler