Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Unable to display time in the powershell script parsing Event Log ?

Posted on 2016-09-13
4
Medium Priority
?
118 Views
Last Modified: 2016-09-13
Hi People,

Can anyone here please help as to why the script below can display the rest of the column but not the time column ?

Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" | Get-EventLog -LogName Security 4720,4722,4725 |
 Select-Object EventId, Time, @{ 
   n='AccountName';
   e={ ($_.message -replace '\n', ' ') -replace '.*?account name:\t+([^\s]+).*', '$1' } 
 }, @{
   n='TargetAccount';
   e={ ($_.message -replace '\n', ' ') -replace '.*account name:\t+([^\s]+).*', '$1' } 
 } 

Open in new window


Am I missing anything here ?
0
Comment
  • 2
  • 2
4 Comments
 
LVL 85

Expert Comment

by:oBdA
ID: 41797345
The events returned don't have a property "Time". Try "TimeGenerated" instead.
1
 
LVL 8

Author Comment

by:Senior IT System Engineer
ID: 41797360
OBDA,

Thanks for the clarification,

somehow the pipe does not work ?

Get-EventLog : The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take
pipeline input.
0
 
LVL 85

Accepted Solution

by:
oBdA earned 2000 total points
ID: 41797366
Sorry, didn't verify that part.
The ComputerName argument doesn't accept pipeline input, so you'll need a ForEach-Object:
Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" |
	ForEach-Object {
		"Processing $($_.DNSHostName) ..." | Write-Host
		Get-EventLog -ComputerName $_.DNSHostName -LogName Security 4720, 4722, 4725 |
		Select-Object -Property `
			EventId,
			TimeGenerated,
			@{n='AccountName'; e={ ($_.message -replace '\n', ' ') -replace '.*?account name:\t+([^\s]+).*', '$1' }},
			@{n='TargetAccount'; e={ ($_.message -replace '\n', ' ') -replace '.*account name:\t+([^\s]+).*', '$1' }}
	}

Open in new window

1
 
LVL 8

Author Closing Comment

by:Senior IT System Engineer
ID: 41797375
You are awesome man !
Thanks
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

By default Outlook 2016 displays only one time zone in the Calendar. The following article explains how to display two time zones in one calendar view.
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question