1

I am extremely new to PowerShell I am trying to create a script that will look thought the system event log and pull out the items that match Error, Verbose , and Warnings; Then I want to export them to a CSV file.

I was able to get each of the variables created for the $errorlog, $verboselog, and $warninglog (shown below).

$errorlog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Error'}
$verboselog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Verbose'}
$warninglog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Warning'}

When I go ahead and try export them to one CSV file it just displays the $errorlog. From what I have gather from various websites the command I am using should be working.

$errorlog,$verboselog,$waninglog | Export-CSV -inputobject  -path 'C:\service\test.CSV'

It is tell me that is it missing '-inputobject' so I moved the variables around to look like the following. 

Export-CSV -inputobject  $errorlog,$verboselog,$warninglog  -path 'C:\service\test.CSV'

It exported with out error but it didn't display the data I wanted in the file.

I thank you in advance for your help.

Mike Zboray
  • 39,828
  • 3
  • 90
  • 122
Sean Donohue
  • 13
  • 2
  • I realize that there is a spelling error in the $warninglog variable. This is not a issue on my computer though. – Sean Donohue Feb 11 '15 at 21:28
  • I would guess your output is empty? What happens if you replace -match with -eq? – Trey Nuckolls Feb 11 '15 at 21:38
  • It errors out and I get the following message: 'Export-Csv : Missing an argument for parameter 'InputObject'. Specify a parameter of type 'System.Management.Automation.PSObject' and try again. At line:1 char:47 + $errorlog,$verboselog,$waninglog | Export-CSV -inputobject -path 'C:\service\test.CSV' – Sean Donohue Feb 11 '15 at 21:41

1 Answers1

2
$errorlog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Error'}
$verboselog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Verbose'}
$warninglog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Warning'}
$errorlog+$verboselog+$warninglog | Export-Csv C:\service\test.CSV

I replaced the -match with -eq and dropped the inputobject switch. I also changed the commas to plus symbols to concantinate the results. This worked for me.

Trey Nuckolls
  • 581
  • 6
  • 21
  • It is exporting data now but on from '$errorlog' and nothing else. – Sean Donohue Feb 12 '15 at 13:35
  • Can you verify that you get a result on the other types by running the 'Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq "Warning"}' line? It may be that it's not picking up any matching entries from how many you are selecting. If you don't get any returns you might want to up that number from 200. Also, I don't show that there is an entry type of verbose so I'm not sure that will return anything. Perhaps information is what you are looking for? https://msdn.microsoft.com/en-us/library/zyysk5d0%28v=vs.90%29.aspx – Trey Nuckolls Feb 12 '15 at 14:17
  • I am trying to gather the information from the event logs for the last month of data from a server; as part of a monthly proactive. – Sean Donohue Feb 12 '15 at 14:20
  • Understood. Do you get any result from running Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq "Warning"} ? If not how about Get-EventLog system -Newest 1000| Where-Object {$_.entryType -eq "Warning"} ? – Trey Nuckolls Feb 12 '15 at 14:32
  • I extended it 2000 and got results I changed verbose to critical and I am not getting results. Thank you for all your help! I will post here with the final script when I have it completed and working. – Sean Donohue Feb 12 '15 at 14:41