Avatar of gd6627
gd6627
Flag for United States of America asked on

change the output format of PS script

How can i convert the outpout of this script to use 


|export-csv instead of txt ?


Select-Object -Expandproperty Message `
    | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
    $Codeintegritylogs | out-file $devicename"_CIEventlogs.txt"

Powershell

Avatar of undefined
Last Comment
footech

8/22/2022 - Mon
DEMAN-BARCELO (MVP) Thierry

Do you mean something like that ? :

Select-Object -Expandproperty Message `
    | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
    $Codeintegritylogs |export-csv -path $devicename"_CIEventlogs.csv" -delimiter "," -notypeinformation -encoding UTF8
gd6627

ASKER
am getting a null value heres the script
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -logName 'Microsoft-Windows-CodeIntegrity/Operational' | Select-Object -Expandproperty Message | Where-Object{ $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7))} `
    $Codeintegritylogs | export-csv -path $devicename"_CIEventlogs.csv" -delimiter "," -notypeinformation -encoding UTF8
footech

To pipe objects to Export-CSV those objects have to be complex objects, they can't be simple objects like a [string] or [int] type.  Some examples:

This won't work.
"this is a string" | Export-CSV "c:\temp\output.txt"

Open in new window


This works.
[pscustomobject]@{"Property1" = "this is a string"} | Export-CSV "c:\temp\output.txt"

Open in new window


The data in the properties of the complex object has to be a string (or directly convertible to a string, like an int).  The reason for this is simple, a .CSV is only string data - the headers are strings, the fields are strings.

I can't be sure from the limited code you showed, but it looks like perhaps you're retrieving data from event logs (actually you just confirmed this with your previous post, written while I was typing this up).  If you expand the Message property, that is only a string (simple object).  You can have just the message property if you want, but you can't expand it if it's a string type.  Once you expand it, you don't have access to the other properties of the event objects like TimeCreated.  Piping to Get-Member can be your friend here for investigation.
Get-WinEvent -FilterHashtable @{ logname="application"} -MaxEvents 5 |
 Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `|
 Select-Object  Message |
 Export-CSV "$($devicename)_CIEventlogs.txt"

Open in new window

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
gd6627

ASKER
footech not working
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
| Select-Object  Message | Export-CSV "$ ($devicename)_CIEventlogs.csv"


error message

PS C:\Temp>
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
| Select-Object  Message | Export-CSV "$($devicename)_CIEventlogs.csv"
The hash literal was incomplete.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : IncompleteHashLiteral
 





ASKER CERTIFIED SOLUTION
footech

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question