Extracting a String using Regex

Welcome Forums General PowerShell Q&A Extracting a String using Regex

This topic contains 6 replies, has 4 voices, and was last updated by

4 years, 6 months ago.

  • Author
  • #15657

    Points: 0
    Rank: Member

    I'm wanting to pull the "Account Name: Person's name" from the Message property under Get-Eventlog. After i pipe it i use the hash table below, but it pulls the all the property Message's message. I tried using "\b" for boundaries but didn't change. I am trying to learn regular expression, so not sure if I am misunderstanding the expressions meanings.

    select @{n='Message'; e={$_.Message -replace "'^(Account Name:.)$','$1'}}

    Thank you for any help

  • #15658

    Points: 24
    Team Member
    Rank: Member


    Would you be able to attach a full example of the event log message (obfuscate any sensitive info) and the command line used to retrieve it?

  • #15660

    Points: 0
    Rank: Member

    Get-EventLog -LogName Security -InstanceId 4624 | select TimeGenerated, @{n='Message'; e={$_.Message -replace “'^(Account Name:.)$','$1′}} | format-list

  • #15663

    Points: 0
    Rank: Member

    sorry I thought you meant event cmd that i was using

    Message : An account was successfully logged on.

    Security ID: S-1-5-18
    Account Name: SO-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7

    Logon Type: 2

    New Logon:
    Security ID: S-1-5-21-2415982056-31499485-2897633832-1007
    Account Name: Salamone
    Account Domain: SO-PC
    Logon ID: 0x1ec8b42
    Logon GUID: {00000000-0000-0000-0000-000000000000}

    Process Information:
    Process ID: 0x12ec
    Process Name: C:\Windows\System32\winlogon.exe

    Network Information:
    Workstation Name: SCOO-PC
    Source Network Address:
    Source Port: 0

    Detailed Authentication Information:
    Logon Process: User32
    Authentication Package: Negotiate
    Transited Services: –
    Package Name (NTLM only): –
    Key Length: 0

    This event is generated when a logon session is created. It is genera.....

  • #15669

    Points: 0
    Rank: Member

    Nice Mike 🙂 PowerShell is soo powerful so one tend to forget the simplest of ways to use it! 🙂

  • #15668

    Points: 53
    Rank: Member

    There's an easier way. Use the ReplacementStrings collection instead of the message property:

    Get-EventLog -LogName Security -InstanceId 4624 -Newest 1 | Select-Object -Property TimeGenerated, @{Label='UserName';Expression={$_.ReplacementStrings[1]}}
  • #15723

    Points: 0
    Rank: Member

    That worked perfectly thank you.

The topic ‘Extracting a String using Regex’ is closed to new replies.