Please help me. Trying to use the variable as a value for subsequent processing does not work. I use it like this:
$SourceLog = 'System'
$Begin = "03/06/2021 10:50:54"
$End = "03/06/2021 13:50:54"
$file = "$PSScriptRoot\ignore.txt"
$DB = Get-Content $file
$arr = @(foreach ($Data in $DB) {
$First, $Second, $Third, $Fourth = $Data -split ',' -replace '^\s*|\s*$'
$fe="!(`$_.Source` -like '$First' -and `$_.EventID` -eq '$Second')"
write-output "$fe"
})
$a = $arr -join " -and "
$a="($a)"
$a=write-output 'Where-Object -FilterScript {' "$a" '}'
write-host 1- $a
$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" | %{ $a } | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique
write-output $request | ConvertTo-Json
the $a variable is not exposed. He also tried:
$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" | Where-Object -FilterScript { $a } | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique
File ignore.txt contains:
Zabbix test event,998
Zabbix test event1,998
create this events:
eventcreate /t ERROR /id 998 /l system /so "Zabbix test event" /d "Test ERROR event 999 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")" ; eventcreate /t ERROR /id 998 /l system /so "Zabbix test event1" /d "Test ERROR event 998 log by Zabbix - $(Get-Date -UFormat "%m/%d/%Y - %T")"
In one version, I get a void in the output, with different attempts to open the variable, sometimes I received an error message "Expressions are only allowed as the first element of a pipeline"
I tried to do as in the answer to the article, but it did not work: Basic PowerShell Script Issue: "Expressions are only allowed as the first element of a pipeline"
if I understand your script correct you want to get all eventlog entries but not those that match the pattern of "ignore.txt". to achive this you have to create ScriptBlock out of the string $a
:
$a = $arr -join " -and "
$a="($a)"
# REMOVED: $a=write-output 'Where-Object -FilterScript {' "$a" '}'
$a = [Scriptblock]::Create($a)
and then use that ScriptBlock directly as FilterScript like:
$request = Get-EventLog -LogName "$SourceLog" -After "$Begin" -Before "$End" | Where-Object -FilterScript $a | Select-Object -Property Index,TimeWritten,EventID,Source,Message | Sort-Object -Descending TimeWritten | Sort-Object EventID,Source -Unique
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments