Get-Eventlog from Remote PC's using Variable

Welcome Forums General PowerShell Q&A Get-Eventlog from Remote PC's using Variable

This topic contains 4 replies, has 2 voices, and was last updated by

 
Participant
3 years, 8 months ago.

  • Author
    Posts
  • #22585

    Participant
    Points: 0
    Rank: Member

    Good morning,

    I have a command line that I've been working on to get data from event logs across multiple remote PC's. My command works when I list the computer names out, but it does not work if I try to put them in a variable and try to run it using the variable instead of the machine names.

    Here is the working code:

    get-eventlog -ComputerName PTLW2TYFLK1WIT, PTLL95S7YY1, PTLWC56MXV1WIT -logname Application | select -Property MachineName, TimeWritten, EventID, Source, Message | Where-Object Source -EQ MsiInstaller |sort -Property MachineName, TimeWritten -Descending | ConvertTo-Html | out-file c:\temp\systemlog.htm

    But if I try to put those 3 machines into variable $machine and replace the three machine names in the code with the $machine variable, I get the following error:

    get-eventlog : The network path was not found.
    At line:1 char:1
    + get-eventlog -ComputerName $machine -logname Application | select -Property Mac ...

    I've tried tweaking this all sorts of different ways to get it to read the $machine variable because it would be nice if I could import a large list of machines into the variable and then run the command that way.

  • #22586

    Member
    Points: 0
    Rank: Member

    We'd need to see the variable, but I suspect that you've created a single string with comma-separated values, instead of an array of strings:

    # This is wrong:
    
    $machine = 'PTLW2TYFLK1WIT, PTLL95S7YY1, PTLWC56MXV1WIT'
    
    # This is right:
    
    $machine = 'PTLW2TYFLK1WIT', 'PTLL95S7YY1', 'PTLWC56MXV1WIT'
    
    • #22591

      Participant
      Points: 0
      Rank: Member

      Thank you, that was definitely the issue. So knowing what I know now, that I need to set them as an array and not just one string, I then thought I could use:

      $machine = Get-Content C:\Temp\users.txt

      In order to import a list of machine names into an array. In the text file they are listed just like this:

      CAELFNWVK12
      CAEL41VVK12
      CAELJ2WVK12
      CAELF12WK12

      And when I check the $machine variable after running that command, they look the same as if I specify them like in your example above. However it errors out with:

      Get-EventLog : Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Provide an
      argument that is not null or empty, and then try the command again.

      I'm assuming that perhaps the way they are in the text file isn't proper.

  • #22592

    Member
    Points: 0
    Rank: Member

    Actually, you're on the right track 🙂 Get-Content does give you an array of strings; each line of the text file becomes a single string. However, based on the error, I think you must have some blank lines in your file, and you'd need to filter those out before passing the values to Get-EventLog. You can do something like this:

    $machine = Get-Content C:\Temp\users.txt | Where-Object { $_ }
    

    This takes advantage of the fact that blank strings are treated as $false in a condition, and non-blank strings are $true, so only the non-blank strings will pass through Where-Object.

  • #22593

    Participant
    Points: 0
    Rank: Member

    That worked like a charm! Good to know I was at least on the right track. PowerShell is impressing me more and more every time I learn something new!

The topic ‘Get-Eventlog from Remote PC's using Variable’ is closed to new replies.