Author Posts

September 4, 2018 at 1:32 pm


I would like to extract the following data:

  • UserStateRunning IE:ProtectedMode
  • Doc:ProtectedMode
  • vSentry:Enabled
  • stage1: Stage1Image0001
  • stage2: Stage2Image0001
  • locationPath: C:\ProgramData\Bromium\vSentry\\Stage2\Stage2Image0001
  • systemMemory: 896MB
  • cpuCount: 2
  • touchEnabled: 1
  • generationCount: 1
  • creationTime: 2018-08-23T16:23:39.0000

From the following string:

UserStateRunning IE:ProtectedMode Doc:ProtectedMode vSentry:Enabled
Running Since[2018-08-27T07:57:59.0000]
Currently Running Template:
 stage1: Stage1Image0001
 stage2: Stage2Image0001
 locationPath: C:\ProgramData\Bromium\vSentry\\Stage2\Stage2Image0001
 systemMemory: 896MB
 cpuCount: 2
 touchEnabled: 1
 generationCount: 1
 creationTime: 2018-08-23T16:23:39.0000

I would like the text before the column to be the header and the text after the column to be the data.

I've tried numerous of different ways in my TemplateContent, but with no success.

Thanks in advance!

September 9, 2018 at 3:59 pm

It would probably be helpful for people to see what you've tried. Everyone's happy to try and help, but asking for a from-scratch solution is often more time-heavy than folks are able to accommodate :).

September 10, 2018 at 1:45 pm

This is a link to another post about Convert-FromString.   It is a worthwhile command to learn and understand.   I use it all the time to parse semi-structured text files.

September 10, 2018 at 3:13 pm

If you can get it to break everything down into a series of lines (one item per line) then you can use ConvertFrom-StringData.

$InputData -replace '$(?< =[\w ]+):','=' | ConvertFrom-StringData