Link to home
Start Free TrialLog in
Avatar of gd6627
gd6627Flag for United States of America

asked on

change the output format of PS script

How can i convert the outpout of this script to use 


|export-csv instead of txt ?


Select-Object -Expandproperty Message `
    | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
    $Codeintegritylogs | out-file $devicename"_CIEventlogs.txt"

Avatar of DEMAN-BARCELO (MVP) Thierry
DEMAN-BARCELO (MVP) Thierry
Flag of France image

Do you mean something like that ? :

Select-Object -Expandproperty Message `
    | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
    $Codeintegritylogs |export-csv -path $devicename"_CIEventlogs.csv" -delimiter "," -notypeinformation -encoding UTF8
Avatar of gd6627

ASKER

am getting a null value heres the script
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -logName 'Microsoft-Windows-CodeIntegrity/Operational' | Select-Object -Expandproperty Message | Where-Object{ $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7))} `
    $Codeintegritylogs | export-csv -path $devicename"_CIEventlogs.csv" -delimiter "," -notypeinformation -encoding UTF8
To pipe objects to Export-CSV those objects have to be complex objects, they can't be simple objects like a [string] or [int] type.  Some examples:

This won't work.
"this is a string" | Export-CSV "c:\temp\output.txt"

Open in new window


This works.
[pscustomobject]@{"Property1" = "this is a string"} | Export-CSV "c:\temp\output.txt"

Open in new window


The data in the properties of the complex object has to be a string (or directly convertible to a string, like an int).  The reason for this is simple, a .CSV is only string data - the headers are strings, the fields are strings.

I can't be sure from the limited code you showed, but it looks like perhaps you're retrieving data from event logs (actually you just confirmed this with your previous post, written while I was typing this up).  If you expand the Message property, that is only a string (simple object).  You can have just the message property if you want, but you can't expand it if it's a string type.  Once you expand it, you don't have access to the other properties of the event objects like TimeCreated.  Piping to Get-Member can be your friend here for investigation.
Get-WinEvent -FilterHashtable @{ logname="application"} -MaxEvents 5 |
 Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `|
 Select-Object  Message |
 Export-CSV "$($devicename)_CIEventlogs.txt"

Open in new window

Avatar of gd6627

ASKER

footech not working
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
| Select-Object  Message | Export-CSV "$ ($devicename)_CIEventlogs.csv"


error message

PS C:\Temp>
Set-location C:\Temp
$deviname = [System.net.dns]::GetHostName()
$startdate = (Get-date).Adddays(-7)
$Codeintegritylogs = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.TimeCreated -ge ((get-Date) - (NewTimespan -day 7)) } `
| Select-Object  Message | Export-CSV "$($devicename)_CIEventlogs.csv"
The hash literal was incomplete.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : IncompleteHashLiteral
 





ASKER CERTIFIED SOLUTION
Avatar of footech
footech
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial