get-winevent -path query

hi Experts!

From a saved event log (of Application) I tried the following ps1 to select the evtx file:

function RemoveBlankSpaces ([string]$streng) {
        [string]$Temp = ((($streng -Replace "`r|`n|`t", "") -replace "\s{2,100}"," ") -replace "\s:",":").Trim()
        $Length = $Temp.length
        [int] $Limit = 950
        if ($length -gt $Limit) {
                return $temp.remove($Limit,($Length-$limit))
        } else {
                return $temp
$out = @()
$evts = get-winevent -path "C:\Data\CustomLog\CustomLogapp01-07-2011@17-51-29.evtx"  
foreach($evt in $evts){
$mess = RemoveBlankSpaces($evt.Message)
#$out += "$($evt.ProvideName),$($EntryType),$($evt.TimeCreated),$mess"
$out += "$($evt.*)"
$out | out-file -filepath .\error.txt

Open in new window


in the error.txt file I would get this:

,,12/29/2010 14:15:06,
,,12/29/2010 14:15:06,
,,12/29/2010 14:15:06,

The source name, error type and message are missing.

Any idea how to correct the script above?
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

Chris DentConnect With a Mentor PowerShell DeveloperCommented:

You have a typo for ProviderName (missing an R, you have ProvideName).

$EntryType is defined as a variable, and has no value in the script above. Did you mean $_.EntryType? And does that property actually exist in your output?

I can't really see a problem with $mess, it works for me.

I suggest you consider a structure like this though:
Get-WinEvent -path "C:\Data\CustomLog\CustomLogapp01-07-2011@17-51-29.evtx" |
  Select-Object ProviderName, EntryType, TimeCreated, @{n='Message';e={ RemoveBlankSpaces($_.Message) }} |
  Export-Csv "error.csv" -NoTypeInformation

Open in new window

allanau20Author Commented:
Super Chris; I will definitely try it and let you know. Thx!
allanau20Author Commented:
hi Chris,

I ran it and now I do see the ProviderName. However, the EntryType is blank and the Message is mostly blank. What I mean is that, and this is what I think, event messages that looks like it's on a single line does get displayed, but if it's broken into multiple lines then it doesn't get displayed.
Then again, I noticed that there might be some exception where the following has only first 4 lines displayed:

Event code: 3001
Event message: The request has been aborted.
Event time: 12/29/2010 7:42:50 AM
Event time (UTC): 12/29/2010 5:42:50 PM
Event ID: fec46fa7242247c1831f2e642274a764
Event sequence: 819
Event occurrence: 2
Event detail code: 0

Any ideas? TIA!!
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

allanau20Author Commented:
Hi Chris,

I even tried not using the message function and the results are the same:

  Select-Object ProviderName, EntryType, TimeCreated, Message  |
allanau20Author Commented:
Chris DentPowerShell DeveloperCommented:

EntryType doesn't exist as a property in the logs I have. I suggest you check that it does for yours with:

Get-WinEvent ... -MaxEvents 1 | Format-List *

Message... start by checking you can capture the message as normal, then it's time to test the function you've written. I didn't do a lot of testing there, it worked fine for the one example I tried, but it was only one.

allanau20Author Commented:

Just want to let you know that I haven't forgotten this question; apparent Get-WinEvent doesn't work on me XP puter; so waiting for a R2 to being build. Will let you know. Thx!
allanau20Author Commented:
sorry; I haven't ababdon this question ... it's a pain waiting for the box to be built ...
allanau20Author Commented:
I will definite let you know ... and not abandon this question. Thanks!
All Courses

From novice to tech pro — start learning today.