Powershell select A string and After a word
My question Is there a way to select Virtualname with select-string? I have these logs from where I need to select the time and virtual account name. I
*> <event seq="453211" time="2019-01-24 11:01:03.639873 -0500" app="hServer 7.45" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
<session id="44500" service="SSH" remoteAddress="00.00.00:57292" virtualAccount="xxxxxxxx" windowsAccount="Server3Users"/>
<channel type="session" id="1"/>
<sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">*
This is what I tried so far.
New-Item "C:clients.log" -type file -force
$strings = "virtualAccount=","time="
Foreach($string in $strings){
Get-Content 'C:uploads.log'|
Select-String $string1 -AllMatches | % { $_.Matches } | % { $_.Value } |
Add-Content "C:clients.log"
}
powershell
asked Jan 25 at 13:04
Jon drewJon drew
31
add a comment |
My question Is there a way to select Virtualname with select-string? I have these logs from where I need to select the time and virtual account name. I
*> <event seq="453211" time="2019-01-24 11:01:03.639873 -0500" app="hServer 7.45" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
<session id="44500" service="SSH" remoteAddress="00.00.00:57292" virtualAccount="xxxxxxxx" windowsAccount="Server3Users"/>
<channel type="session" id="1"/>
<sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">*
This is what I tried so far.
New-Item "C:clients.log" -type file -force
$strings = "virtualAccount=","time="
Foreach($string in $strings){
Get-Content 'C:uploads.log'|
Select-String $string1 -AllMatches | % { $_.Matches } | % { $_.Value } |
Add-Content "C:clients.log"
}
powershell
asked Jan 25 at 13:04
Jon drewJon drew
31
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
You should show what results you do expect.
– LotPings
Jan 25 at 18:57
add a comment |
My question Is there a way to select Virtualname with select-string? I have these logs from where I need to select the time and virtual account name. I
*> <event seq="453211" time="2019-01-24 11:01:03.639873 -0500" app="hServer 7.45" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
<session id="44500" service="SSH" remoteAddress="00.00.00:57292" virtualAccount="xxxxxxxx" windowsAccount="Server3Users"/>
<channel type="session" id="1"/>
<sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">*
This is what I tried so far.
New-Item "C:clients.log" -type file -force
$strings = "virtualAccount=","time="
Foreach($string in $strings){
Get-Content 'C:uploads.log'|
Select-String $string1 -AllMatches | % { $_.Matches } | % { $_.Value } |
Add-Content "C:clients.log"
}
powershell
asked Jan 25 at 13:04
Jon drewJon drew
31
My question Is there a way to select Virtualname with select-string? I have these logs from where I need to select the time and virtual account name. I
*> <event seq="453211" time="2019-01-24 11:01:03.639873 -0500" app="hServer 7.45" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
<session id="44500" service="SSH" remoteAddress="00.00.00:57292" virtualAccount="xxxxxxxx" windowsAccount="Server3Users"/>
<channel type="session" id="1"/>
<sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">*
This is what I tried so far.
New-Item "C:clients.log" -type file -force
$strings = "virtualAccount=","time="
Foreach($string in $strings){
Get-Content 'C:uploads.log'|
Select-String $string1 -AllMatches | % { $_.Matches } | % { $_.Value } |
Add-Content "C:clients.log"
}
powershell
powershell
asked Jan 25 at 13:04
Jon drewJon drew
31
asked Jan 25 at 13:04
Jon drewJon drew
31
edited Jan 27 at 4:52
Jon drew
asked Jan 25 at 13:04
Jon drewJon drew
31
asked Jan 25 at 13:04
Jon drewJon drew
31
asked Jan 25 at 13:04
Jon drewJon drew
31
31
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
You should show what results you do expect.
– LotPings
Jan 25 at 18:57
add a comment |
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
You should show what results you do expect.
– LotPings
Jan 25 at 18:57
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
You should show what results you do expect.
– LotPings
Jan 25 at 18:57
You should show what results you do expect.
– LotPings
Jan 25 at 18:57
add a comment |
1 Answer
1
active
oldest
votes
If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.
I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes
foreach ($line in Get-Content 'C:uploads.log') {
$rslt = $line | Select-String -Pattern 'time="([^"]*)".*virtualAccount="([^"]*)"'
$myinfo = [PSCustomObject]@{
Time = $rslt.Matches.Groups[1].Value;
Account = $rslt.Matches.Groups[2].Value
}
$myinfo
}
edited Jan 27 at 11:38
Jon drew
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
No luck errorCannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~
– Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1398350%2fpowershell-select-a-string-and-after-a-word%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.
I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes
foreach ($line in Get-Content 'C:uploads.log') {
$rslt = $line | Select-String -Pattern 'time="([^"]*)".*virtualAccount="([^"]*)"'
$myinfo = [PSCustomObject]@{
Time = $rslt.Matches.Groups[1].Value;
Account = $rslt.Matches.Groups[2].Value
}
$myinfo
}
edited Jan 27 at 11:38
Jon drew
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
No luck errorCannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~
– Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
add a comment |
If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.
I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes
foreach ($line in Get-Content 'C:uploads.log') {
$rslt = $line | Select-String -Pattern 'time="([^"]*)".*virtualAccount="([^"]*)"'
$myinfo = [PSCustomObject]@{
Time = $rslt.Matches.Groups[1].Value;
Account = $rslt.Matches.Groups[2].Value
}
$myinfo
}
edited Jan 27 at 11:38
Jon drew
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
No luck errorCannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~
– Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
add a comment |
If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.
I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes
foreach ($line in Get-Content 'C:uploads.log') {
$rslt = $line | Select-String -Pattern 'time="([^"]*)".*virtualAccount="([^"]*)"'
$myinfo = [PSCustomObject]@{
Time = $rslt.Matches.Groups[1].Value;
Account = $rslt.Matches.Groups[2].Value
}
$myinfo
}
edited Jan 27 at 11:38
Jon drew
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.
I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes
foreach ($line in Get-Content 'C:uploads.log') {
$rslt = $line | Select-String -Pattern 'time="([^"]*)".*virtualAccount="([^"]*)"'
$myinfo = [PSCustomObject]@{
Time = $rslt.Matches.Groups[1].Value;
Account = $rslt.Matches.Groups[2].Value
}
$myinfo
}
edited Jan 27 at 11:38
Jon drew
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
edited Jan 27 at 11:38
Jon drew
31
edited Jan 27 at 11:38
Jon drew
31
edited Jan 27 at 11:38
Jon drew
31
31
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
answered Jan 25 at 14:38
Gert Jan KraaijeveldGert Jan Kraaijeveld
20816
20816
No luck errorCannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~
– Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
add a comment |
No luck errorCannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~
– Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
No luck error
Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ – Jon drew
Jan 28 at 8:43
No luck error
Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) , RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ – Jon drew
Jan 28 at 8:43
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch
– Gert Jan Kraaijeveld
Jan 28 at 9:46
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
Yeah got, I will need to copy all in one line, thats gona be tough work
– Jon drew
Jan 28 at 9:51
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1398350%2fpowershell-select-a-string-and-after-a-word%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example?
– Gert Jan Kraaijeveld
Jan 25 at 13:30
There are more, its just one line I copied
– Jon drew
Jan 25 at 13:54
You should show what results you do expect.
– LotPings
Jan 25 at 18:57