$Date = (get-date) - (new-timespan -day 1)
$PrintEntries = get-winevent -computername <servername> -logname Microsoft-Windows-PrintService/Operational | where {$_.timecreated -ge $Date} | where {$_.Id -eq 307}

 ForEach ($PrintEntry in $PrintEntries)
 {
  #Get date and time of printjob from TimeCreated
  $Date_Time = $PrintEntry.TimeCreated

  #get Message from printjob.
  $rawMessage = $PrintEntry.Message

  #parse $rawMessage to get owner
  $rxUserName = [regex]"owned by ([0-9a-zA-Z]{1,}) on"
  $rawUser = $rxUserName.Match($rawMessage)
  $Username = $rawUser.Groups[1].Value

  #parse $rawMessage to get document name
  $rxDocumentName = [regex]", ([a-zA-Z-_:/\[#\]\?\\\=\d\.\s\(\)&-,]{1,}) owned by"
  $rxMatches = $rxDocumentName.Match($rawMessage)
  $docName = $rxMatches.Groups[1].Value

  #parse $rawMessage to get printername
  $rxPrinterName = [regex]"was printed on ([0-9a-zA-Z\-]{1,}) through"
  $rxMatches = $rxPrinterName.Match($rawMessage)
  $PrinterName = $rxMatches.Groups[1].Value

  #parse $rawMessage to get print size
  $rxPrintSize = [regex]"Size in bytes: ([0-9]+)."
  $rxMatches = $rxPrintSize.Match($rawMessage)
  $PrintSize = $rxMatches.Groups[1].Value

  #parse $rawMessage to get number of pages
  $rxPageCount = [regex]"Pages printed\: ([0-9]+)."
  $rxMatches = $rxPageCount.Match($rawMessage)
  $PrintPages = $rxMatches.Groups[1].Value

  #Get full name from AD
  if ($UserName -gt "")
  {
   $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher
   $LdapFilter = "(&(objectClass=user)(samAccountName=${UserName}))"
   $DirectorySearcher.Filter = $LdapFilter
   $UserEntry = [adsi]"$($DirectorySearcher.FindOne().Path)"
   $ADName = $UserEntry.displayName
  }


$Date_Time
#$rawMessage
$UserName
$ADName
$PrinterName
$PrintSize
$PrintPages
$docName

}

Write-Host "collecting event logs..."
$Date = (get-date) - (new-timespan -day 1)
$PrintEntries = Get-WinEvent -ea SilentlyContinue -ComputerName SERVERNAME -FilterHashTable @{ProviderName="Microsoft-Windows-PrintService"; StartTime=$Date; ID=307}
$strOutput = ""
$File = "Printing Audit - " + (Get-Date).ToString("yyyy-MM-dd") + ".csv"
write-output "Date|Username|Full Name|Client|Printer Name|Print Size|Pages|Document" | Out-File $File
write-Host "Parsing event log entries..."

ForEach ($PrintEntry in $PrintEntries)
 { 
 #Get date and time of printjob from TimeCreated
 $Date_Time = $PrintEntry.TimeCreated
 $entry = [xml]$PrintEntry.ToXml() 
 $docName = $entry.Event.UserData.DocumentPrinted.Param2
 $Username = $entry.Event.UserData.DocumentPrinted.Param3
 $Client = $entry.Event.UserData.DocumentPrinted.Param4
 $PrinterName = $entry.Event.UserData.DocumentPrinted.Param5
 $PrintSize = $entry.Event.UserData.DocumentPrinted.Param7
 $PrintPages = $entry.Event.UserData.DocumentPrinted.Param8

 #Get full name from AD
 if ($UserName -gt "")
 {
  $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher
  $LdapFilter = "(&(objectClass=user)(samAccountName=${UserName}))"
  $DirectorySearcher.Filter = $LdapFilter
  $UserEntry = [adsi]"$($DirectorySearcher.FindOne().Path)"
  $ADName = $UserEntry.displayName
 }
 
 #$rawMessage
 $strOutput = $Date_Time.ToString()+ "|" +$UserName+ "|" +$ADName+ "|" +$Client+ "|" +$PrinterName+ "|" +$PrintSize+ "|" +$PrintPages+ "|" +$docName
 write-output $strOutput | Out-File $File -append  
}