1
Get-EventLog -Logname system -Source "Microsoft-Windows-GroupPolicy" -EntryType "Information"| group-object -property source | sort-object -property Time -descending

It does group everything together and counts it but I want the count to be also by day.

Results be like:

02.10.2015 10 Microsoft-Windows......
04.11.2016 2  Microsoft-Windows.....
08.11.2016 13 Microsoft-Windows......

and so on.

How can I get the date splitting in there?

alroc
  • 27,574
  • 6
  • 51
  • 97
Thevagabond
  • 323
  • 2
  • 9
  • 34

1 Answers1

2

You can group by two different properties and we can fabricate a property to hold the day as a string.

Get-EventLog -Logname system -Source "Microsoft-Windows-GroupPolicy" -EntryType "Information" |
    Add-Member Day -MemberType ScriptProperty -Value { $this.TimeGenerated.ToString('dd.MM.yyyy') } -PassThru |
    Group-Object 'Day', 'Source'
Chris Dent
  • 3,910
  • 15
  • 15
  • Wow great just what I needed, now I just need to understand what you did there :-) – Thevagabond Aug 19 '16 at 12:32
  • 1
    For each of the events we're adding a new calculated property which will hold the date as a formatted string. It groups everything by the calculated property Day first then by event source. `$this` is a special variable used to access the thing we added the property to, so the little script block is specific to each event. – Chris Dent Aug 19 '16 at 12:35