Well, this is where it starts to get a little fun - taking a script and turning
it into a full-blown reporting application. :-P
The problem, at heart, is that the logs are CSV files, and Select-String
doesn't return a "simple string" (i.e., a line of text). Instead, it returns
something called a "match object" which is the result from a regular expression
search.
Your first line of output needs to be the CSV header from the first log file,
and then you need to output ONLY the ToString() output from each match object.
Don't use export-csv, because the files are ALREADY a CSV.
Hint, untested but it'll go something very much like this:
$logs = Get-ChildItem '\\serverName\d$\Research in
Motion\BlackBerry Enterprise Server\Logs\*' -Recurse -Include PhoneCallLog*.csv
$logHeader = gc $logs[0] -TotalCount 1
$results = $logs | Select-String -SimpleMatch -Pattern "Steven Peck"
$outputArray = @()
$outputArray += $logHeader
foreach( $result in $results )
{
$outputArray += $result.Line
}
$outputArray | out-file -encoding ascii filename.csv
### yes, I believe in cleaning up after myself
$outputArray = $null
$results = $null
$logs = $null
Regards,
Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com
From: Steven Peck [mailto:[email protected]]
Sent: Monday, September 27, 2010 2:10 PM
To: NT System Admin Issues
Subject: Re: BES Logs
so yes. this works but is still not as pretty as it could be.
PS:\> Get-ChildItem '\\serverName\d$\Research in Motion\BlackBerry Enterprise
Server\Logs\*' -Recurse -Include PhoneCallLog*.csv | Select-String -SimpleMatch
-Pattern "Steven Peck" | export-csv ./filename.csv -NoTypeInformation
When exploring, I tend to stick things in variables so I can play with them.
PS:\> $logs = Get-ChildItem '\\serverName\d$\Research in Motion\BlackBerry
Enterprise Server\Logs\*' -Recurse -Include PhoneCallLog*.csv | Select-String
-SimpleMatch -Pattern "Steven Peck"
PS:> $logs | Get-Memeber -memberType Property
Name MemberType Definition
---- ---------- ----------
Context Property Microsoft.PowerShell.Commands.MatchInfoContext Context
{get;set;}
Filename Property System.String Filename {get;}
IgnoreCase Property System.Boolean IgnoreCase {get;set;}
Line Property System.String Line {get;set;}
LineNumber Property System.Int32 LineNumber {get;set;}
Matches Property System.Text.RegularExpressions.Match[] Matches {get;set;}
Path Property System.String Path {get;set;}
Pattern Property System.String Pattern {get;set;}
About the only thing that seems interesting to me are Line, Filename, and
Pattern
Line because it has the match, filename as it has the log file date and pattern
to remind myself what I was searching for.
PS:> $logs | Select Filename, Pattern, Line -first 5
that shows if it's what I want.
PS:> $logs | Select Filename, Pattern, Line | Export-Csv ./file.csv
-NoTypeInformation
Trivia you need -NoTypeInformation or dotNet puts a type line as the first
entry in the file.
Now that gets you a lot of the way there, but Line still would benefit from
being parsed out. I am pretty sure there is a way to split it up but don't
have time to play with it this morning. I put it on my white board as a follow
up just because knowing how would be useful later.
oh, you can skip the variable and just do this....
PS:\> Get-ChildItem '\\serverName\d$\Research in Motion\BlackBerry Enterprise
Server\Logs\*' -Recurse -Include PhoneCallLog*.csv | Select-String -SimpleMatch
-Pattern "Steven Peck" | Select Filename, Pattern, Line | Export-Csv ./file.csv
-NoTypeInformation
I thought I would show you how I arrived at this though. Micheal may have a
way better way to get to this point, but I'm not there yet. I put some good
PowerShell links in a block on my website, free eBook, collection of blogs and
such. I am adding to it as I find things.
Steven Peck
www.blkmtn.org<http://www.blkmtn.org>
On Mon, Sep 27, 2010 at 10:22 AM, Stefan Jafs
<[email protected]<mailto:[email protected]>> wrote:
Great that worked like a charm! But it did require a bit of work to make it
look good in Excel, would it be possible to pipe directly to a CSV file?
SJ
On Fri, Sep 24, 2010 at 4:58 PM, Steven Peck
<[email protected]<mailto:[email protected]>> wrote:
I just tested this and it pulled all my activity off my logs.
PS:\> Get-ChildItem '\\serverName\d$\Research in Motion\BlackBerry Enterprise
Server\Logs\*' -Recurse -Include PhoneCallLog*.csv | Select-String -SimpleMatch
-Pattern "Steven Peck"
On Fri, Sep 24, 2010 at 1:48 PM, Stefan Jafs
<[email protected]<mailto:[email protected]>> wrote:
Thanks Michael, I'll play with findstr
SJ
On Fri, Sep 24, 2010 at 4:40 PM, Michael B. Smith
<[email protected]<mailto:[email protected]>> wrote:
Oh, this is so much easier using find (Unix version) or findstr (cmd.exe
version). Such as:
Cd /d c:\log-file-directory
findstr /i /s /c:"literal-search-string" PhoneCallLog*.csv
PowerShell would go something like:
Get-ChildItem c:\log-file-directory\* -recurse -include
PhoneCallLog*.csv | select-string -simplematch -pattern "literal-search-string"
You can do a LOT more with the PowerShell command(s), but in this simple case,
cmd.exe is easier to use.
Regards,
Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com<http://theessentialexchange.com/>
From: Stefan Jafs [mailto:[email protected]<mailto:[email protected]>]
Sent: Friday, September 24, 2010 4:26 PM
To: NT System Admin Issues
Subject: Re: BES Logs
Any chance you could do a few PS lines for me with the following conditions:
Logs Directory each day has a folder with the date (20100923) then the phone
log is PhoneCalllog_20100923.csv, I would just like to search for particular
phone number.
SJ
On Fri, Sep 24, 2010 at 4:14 PM, Michael B. Smith
<[email protected]<mailto:[email protected]>> wrote:
Findstr, grep, awk, sed, PowerShell, WinGrep, etc. etc.... all have multi-file
capabilities.
Regards,
Michael B. Smith
Consultant and Exchange MVP
http://TheEssentialExchange.com<http://theessentialexchange.com/>
From: Stefan Jafs [mailto:[email protected]<mailto:[email protected]>]
Sent: Friday, September 24, 2010 4:11 PM
To: NT System Admin Issues
Subject: BES Logs
Running BES 5 and need to find phone activity's for 1 device for the last 6
months. Is there an easy way or do I have to look at the log files 1 day at the
time? sigh . . . . .
--
Stefan Jafs
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
--
Stefan Jafs
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
--
Stefan Jafs
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
--
Stefan Jafs
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to
[email protected]<mailto:[email protected]>
with the body: unsubscribe ntsysadmin
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to [email protected]
with the body: unsubscribe ntsysadmin
