Eventlog Error Reporting

This topic contains 4 replies, has 2 voices, and was last updated by  37mm 2 years, 2 months ago.

  • Author
    Posts
  • #28483

    37mm
    Participant

    http://pastebin.com/raw.php?i=KBRxapmj
    How can I display each item in the name column separated by , and keep the count column the same.

    I am trying to produce a script that gets the event error log and organize event id by count, under the name column I get the event ID, machine Name, Message. I want the 3 fields to display in there own column to make it easier to read, and keep the count column. Is there a better way of achieving the results?

  • #28484

    Don Jones
    Keymaster

    You'll have to modify your Select-Object, and instead of just selecting the Name property, create a custom ("calculated") property that does what you want. I'm unclear what your data looks like as-is, or I'd offer an example, but broadly:

    Select -Prop Count,@{n='Name';e={ $_.Name -join ","}}

    Is one example of a calculated column, which assumes the Name property is an array, and turns it into a comma-delimited list.

  • #28489

    37mm
    Participant

    Before I go any further, Don Jones I watched many of your videos that got me to the point of where I am at. Thanks for everything you have done!

    Now, when i replace the select Piece with this code it gives me the same read out. I guess I am not grasping what this does. The name property was built from the group-object command which i used to select the fields (eventID, Machinename, Message) I assume this is an array? Excuse my lack of knowledge as I am still trying to grasp these concepts and syntax.

    BTW, 1 last time, Huge fan of your work. You make learning easy for me through your videos, etc....

  • #28490

    37mm
    Participant

    This is what the output looks like

  • #28491

    37mm
    Participant

    get-EventLog -ComputerName $env:COMPUTERNAME -LogName System -EntryType error -after ((get-date).date.AddDays(-7)) | Group-Object eventid, MachineName, Message | select count, @{Name="EventId";Expression={$_.Name.split(',')[0]}}, @{Name="Computername";Expression={$_.Name.split(',')[1]}}, @{Name="Data";Expression={[string]$_.Name.split(',')[2..$_.Name.split(',').length]}}

    A gentleman of Reddit helped me out. Here is the code

You must be logged in to reply to this topic.