EventLogQuery time format expected?

EventLogQuery uses an XML format to query the event log. You can find the schema for the query XML here.

The text of the Select element is an XPath expression evaluated against the XML serialization of events.

You can find the schema for the event XML here.

The TimeCreated element has an attribute SystemTime of type dateTime, so the format of this (in your query XML) is whatever an XPath processor can parse as a valid dateTime (see 3.2.7.1. Lexical representation for the specifics).

For example you can try a query like this:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[TimeCreated[@SystemTime = '2011-12-20T00:42:53.000000000Z']]]</Select>
  </Query>
</QueryList>

Which parses and returns a value if you happen to have an event created exactly at the given date and time.

Also dateDiff is an extension function to the Filter XPath protocol, which takes one or two arguments of SYSTEMTIME type and returns a number, so just use a number in expression with this function (just like in your example).

---

P.S. You can use the Windows Event Viewer (%windir%\system32\eventvwr.msc) to enter and quickly evaluate event query XML by creating Custom Views (Windows Vista, 7 and 2008 only):

Here is another C# for initializing an EventLogQuery object that will load event entires for a specific date range

var startTime = DateTime.Now.AddDays(-1);
var endTime = DateTime.Now;

var query = string.Format("*[System[TimeCreated[@SystemTime >= '{0}']]] and *[System[TimeCreated[@SystemTime <= '{1}']]]",
    startTime.ToUniversalTime().ToString("o"),
    endTime.ToUniversalTime().ToString("o"));

var elq = new EventLogQuery("Applicaton", PathType.LogName, query);

Here's a C# example for initializing an EventLogQuery object that will only load event entries from the last day.

var yesterday = DateTime.UtcNow.AddDays(-1);

var yesterdayDtFormatStr = yesterday.ToString(
   "yyyy-MM-ddTHH:mm:ss.fffffff00K", 
   CultureInfo.InvariantCulture
);

var query = string.Format(
   "*[System/TimeCreated/@SystemTime >='{0}']", 
   yesterdayDtFormatStr
);

var elq = new EventLogQuery("Application", PathType.LogName, query);