PowerShell Get-Winevent按关键字和提供程序名称的问题

我是Powershell的新手，并且已经学习了很多东西。但是还有更多。所以我的代码不是最严格的。

我创建了一个事件日志搜索工具。它使我可以通过ID，错误级别，关键字等进行搜索。在大多数情况下，它可以工作，但关键字和提供者名称除外。

当前，当尝试在日志中搜索关键字或一组关键字时，脚本会提示错误消息：

Get-WinEvent：指定的图像文件不包含资源部分，位于C：\ Users \ Rob \ Google Drive \ Powershell \ Get-logs.ps1：65 char：9 + Get-WinEvent -FilterHashtable @ {Logname = $ Log} -ComputerName $计算机| ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo：未指定：（:) [Get-WinEvent]，EventLogException + FullyQualifiedErrorId：指定的图像文件不包含资源部分，Microsoft.PowerShell.Commands.GetWinEventCommand

问题是，我不了解ps1.65 char：9位。然后，脚本继续运行，并从日志获取与我无关的旧数据。

这是我遇到的两个领域的代码。最后的完整代码。

关键词搜索：

elseif ($Kwrd -gt "a"){
    foreach ($Kwrd in $Kwrd)
    {
        Get-WinEvent -FilterHashtable @{logname=$Log} -ComputerName $Computer | where-object  { $_.Message -like "*$Kwrd*" }  | Sort-Object TimeGenerated -Descending | Select-Object -First $Maxnum | Format-List  
        }
    }

提供商名称搜索：

elseif ($Prov.Length -gt 1){
        Get-WinEvent -FilterHashtable @{Logname=$Log} -ComputerName $Computer | Where-Object {($_.ProviderName -like "*$Prov*")}  | Sort-Object TimeGenerated -Descending|Select-Object -First $Maxnum | Format-List  
        }

因此，例如，如果我想在应用程序日志中搜索提供者名称“系统还原”，（该脚本就是我最近运行的Revo应用程序中的其中一个）。

Enter Computer or EXIT to quit: office
Enter log set to retrieve: application
Enter Instance ID or leave blank: 
Enter number of logs to retrieve: 10
Enter error level or leave blank: 
Search logs by keyword or leave blank: 
Search by Provider or leave blank: System Restore
Get-WinEvent : The specified image file did not contain a resource section
At C:\Users\Rob\Google Drive\Powershell\Get-logs.ps1:65 char:9
+         Get-WinEvent -FilterHashtable @{Logname=$Log} -ComputerName $Computer |  ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], EventLogException
    + FullyQualifiedErrorId : The specified image file did not contain a resource section,Microsoft.PowerShell.Commands.GetWinEventCommand


PS C:\Users\Rob> 

关键字搜索也是同样的问题。同样的错误信息。唯一的不同是行号从65更改为61，因为代码在第61行。

这不是完美的，但是我正在学习。这是完整的脚本。知道如何从日志中获取信息而不会出现错误吗？

Clear-Host

while (1 -ne 2){

$Computer = $Null
$IDNum = $Null
$Lvl = $Null
$Kwrd = $Null
$Prov = $Null


Write-Host ''
$Computer = Read-Host "Enter Computer or EXIT to quit"
if ($Computer -eq "EXIT") {exit;}

$Log = Read-Host "Enter log set to retrieve"
$IDNum = Read-Host "Enter Instance ID or leave blank"
$IDNum = $IDNum.Split(',')
$MaxNum = $MaxNum = Read-Host "Enter number of logs to retrieve"
$Lvl = Read-Host "Enter error level or leave blank"
$Lvl = $Lvl.Split(',')
$Kwrd = Read-Host "Search logs by keyword or leave blank"
$Kwrd = $Kwrd.Split(',')
$Prov = Read-Host "Search by Provider or leave blank"




if ($IDNum.Length -gt 1){

    foreach ($IDNum in $IDNum)
    {
        Get-WinEvent -FilterHashTable @{LogName=$Log; ID=$IDNum} -ComputerName $Computer | Where-Object { ($_.ID -eq "*$IDNum*")} |Sort-Object TimeGenerated -Descending | Select-Object -First $Maxnum| Format-List 
        }
    }

elseif ($Lvl -gt 1 ){
    foreach ($Lvl in $Lvl)
    {
        Get-WinEvent -FilterHashTable @{LogName=$Log;Level=$lvl} -ComputerName $Computer -MaxEvents $MaxNum |Select-Object -First $MaxNum | Sort-Object TimeGenerated -Descending  | Format-List 
        }
    }

elseif ($Kwrd -gt "a"){
    foreach ($Kwrd in $Kwrd)
    {
        Get-WinEvent -FilterHashtable @{logname=$Log} -ComputerName $Computer | where-object  { $_.Message -like "*$Kwrd*" }  | Sort-Object TimeGenerated -Descending | Select-Object -First $Maxnum | Format-List  
        }
    }
elseif ($Prov.Length -gt 1){
        Get-WinEvent -FilterHashtable @{Logname=$Log} -ComputerName $Computer | Where-Object {($_.ProviderName -like "*$Prov*")}  | Sort-Object TimeGenerated -Descending|Select-Object -First $Maxnum | Format-List  
        }

else {
         Get-WinEvent -LogName $Log -ComputerName $Computer  | Sort-Object TimeGenerated -Descending| Select-Object -First $MaxNum | Format-List 
     }



} else{

Clear-Host
$log = $IDNum = $MaxNum = $Lvl = $Kwrd = $Prov = $Null
continue
Write-Host ''
Write-Host ''
}

谢谢。