Powershell Export Event logs

Not sure what I am doing wrong I am trying to get all the different types of logs into a file with server name.  The File path is not coming out correctly.


The function I am user is here
http://www.insidepowershell.com/?p=611



# Import Testing function (also defines prerequisites)
. C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1

$Servers = get-content "C:\NOCScripts\Powershell\GetLogData\splunk\ServerList.txt"
$LogDest = "C:\NOCScripts\Powershell\GetLogData\splunk\evxt"

$LogNamesArry = "Application,Hardware Events,Operations Manager,Security,System,Windows Powershell,Internet Explorer,Key Management Service"
$LogNames = $LogNamesArry.split(',');

$Days_Ago = 1096


FOREACH ($Server in $Servers){
            FOREACH($LogName in $LogNames){
            Write-Host $LogName $Server $Start_Date
             
Write-Host $Server $LogName 
 Export-EventLog -Servers $Server -Logname $LogName -FileName "$Server.evtx" -Path  $LogDest -Days $Days_Ago

        }

}

Open in new window



Output Produced with error
Hardware Events n2sup2is02 

 Export Started 
 Server: n2sup2is02 
 Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 
 Days: 1096 

wevtutil : Failed to export log Hardware Events. The specified channel could not be found. Check channel configuration.
At C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1:126 char:1
+ wevtutil epl $logname "$path\$filename" /ow /r:"$server" /q:"*[System[TimeCreate ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Failed to expor... configuration.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 

 Export Complete: C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 

Open in new window

LVL 8
Leo TorresSQL DeveloperAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

footechCommented:
Your output for the path does not match with the code posted, so something is definitely different than above.  Running the code above with a servername of "localhost", I get a path like
Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\localhos localhost 2015-02-07.evtx
Yes, it says "localhos" at one point because of the way the Trim method works - better would be to use the Replace method so you don't get unexpected results.

As far as the error message, it's because the channel is "HardwareEvents" without a space, so you need to modify line 7 where you define $LogNamesArry.
0
Leo TorresSQL DeveloperAuthor Commented:
The path Name yes is one of my issues not sure why I get that bad path.

Any idea on path issue.
0
footechCommented:
As you can see from the result I posted, there was no problem with the path.

To try to diagnose any issue you're having with the path I would need the command you're running, any file that supplies input, and the output.  As I mentioned, the sample output you provided before does not match with the code as shown, so you must have changed something.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.