troubleshooting Question

display events by log

Avatar of bibi92
bibi92Flag for France asked on
Powershell
5 Comments1 Solution10 ViewsLast Modified:
Hello,

I search to display events by logs : 
$Days = 3
$LogPath = "C:\TEMP\Log"  
$Log = Get-ChildItem -path $LogPath -recurse -include dly*.log
$ListError = 'ERR1014','ERR1016','ERR1012','ERR1011','ERR1013'


$Errorz = Get-Content -Path $Log |
Where-Object { $_ -match 'ERR1013' -and [datetime]::ParseExact((($_ -split ' ')[0] + " " + ($_ -split ' ')[1]), $Format, $null) -gt $Time }


foreach ($lg in $log) {
   $EventList = Get-WinEvent -FilterHashtable @{
                    Logname = 'system'
                    Id = '1074'
                    StartTime = (Get-Date).AddDays(- $Days)
                } -MaxEvents $MaxEvents -ErrorAction SilentlyContinue
   foreach ($Event in $EventList) {


      if ($Event.Id -eq 1074) {
         [PSCustomObject]@{
            TimeStamp    = $Event.TimeCreated
            UserName     = $Event.Properties.value[6]
            ShutdownType = $Event.Properties.value[4]
            Reason       = $Event.Properties.value[2]
         }
   
      }
      


   }
   
}

The result is below if there is three logs :
TimeStamp           UserName            ShutdownType Reason
---------           --------            ------------ ------
12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)
12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)

12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)

How is it possible to display the column for three logs like below:

TimeStamp           UserName            ShutdownType Reason
---------           --------            ------------ ------
12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)
TimeStamp           UserName            ShutdownType Reason
---------           --------            ------------ ------
12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)
TimeStamp           UserName            ShutdownType Reason
---------           --------            ------------ ------
12/05/2021 13:56:56 NT AUTHORITY\SYSTEM restart      Operating System (Planned)

Thank you

Regards
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 5 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros