Compare-Object Find Matches and Remove Found from First Object

Question

I'm wondering if there's a simpler way to accomplish this. I have two (JSON) objects, where they have properties that are lists of IPs (the properties are individual IPs). I'm comparing the two object properties to find any matching items and want to remove any matches from the first object ($JSONConverted). I believe I can use the remove feature (which I haven't gotten working yet). I'm really wondering if there's a simpler way to accomplish this.

$JSONConverted   = Get-Content -Raw -Path Output.json | ConvertFrom-Json
$FWJSONConverted = Get-Content -Raw -Path FWOutput.json | ConvertFrom-Json

$MatchingIPs = Compare-Object -IncludeEqual -ExcludeDifferent -ReferenceObject $FWJSONConverted.data.value -DifferenceObject $JSONConverted.data.value

$ListOfMatchingIPs = $MatchingIPs.InputObject

$JSONConverted.data.value | ForEach-Object {
    foreach ($IP in $ListOfMatchingIPs) {
        if ($_ -eq $IP) {
            $JSONConverted.remove.($_)
        }
    }
}

Here's an example of the $JSONConverted data:

{
  "number_of_elements": 1134,
  "timeout_type": "LAST",
  "name": "IP List",
  "data": [
    {
      "last_seen": 1486571563476,
      "source": "WORD: WORDS",
      "value": "10.10.10.10",
      "first_seen": 1486397213696
    },
    {
      "last_seen": 1486736205285,
      "source": "WORD: WORDS",
      "value": "10.17.24.22",
      "first_seen": 1486397813280
    },
    {
      "last_seen": 1486637743793,
      "source": "WORD: WORDS",
      "value": "10.11.10.10",
      "first_seen": 1486398713056
    }
  ],
  "creation_time": 1486394698941,
  "time_to_live": "1 years 0 mons 3 days 0 hours 0 mins 0.00 secs",
  "element_type":"IP"
}

Do I want to know why you have JSON code in files with the extension .xml? — Ansgar Wiechers, Feb 14 '17 at 21:54
Fixed it. The extension made no difference for what I've been trying to accomplish, at least to my knowledge. — MrMr, Feb 14 '17 at 21:59
Technically it doesn't make a difference. Still, since Windows associates file handlers via the extension using a mismatching extension is rather sloppy. With that said, what does your input data actually look like? Also, I doubt that `$JSONConverted.remove.($_)` would actually remove anything. — Ansgar Wiechers, Feb 14 '17 at 22:07

Ansgar Wiechers · Accepted Answer · 2017-02-14T22:23:24.617

1

Something like this should suffice (assuming you want to remove the entire child object from the data array):

$JSONConverted.data = $JSONConverted.data | Where-Object {
    @($FWJSONConverted.data.value) -notcontains $_.value
}

edited Feb 14 '17 at 22:23

answered Feb 14 '17 at 22:12

Ansgar Wiechers

193,178
25
254
328

This doesn't seemed to have worked. As when I check $jsonconverted.data.value again, the known matching IP's still exist there. I'm trying to remove the entire object (child object?)from the original $jsonconverted object. I should probably add, that the $jsonconverted object and the $FWJSONConverted object are not identical. – MrMr Feb 14 '17 at 22:55
@MrMr It worked when I tested it with your sample data. Please provide evidence. Also, what PowerShell version are you using? – Ansgar Wiechers Feb 14 '17 at 22:58
I apologize, It looks like I missed the .value after $_. This works great, thank you very much. Any chance you would have a moment to help me understand the @() portion? I understand what is happening generally, but why does the @() work? – MrMr Feb 15 '17 at 13:14
1

`@()` is the [array subexpression operator](https://msdn.microsoft.com/en-us/powershell/reference/3.0/microsoft.powershell.core/about/about_operators). It forces the result of `$FWJSONConverted.data.value` to an array, even if that (sub)expression yields only one (or no) result. That is required for `-notcontains` to work correctly. – Ansgar Wiechers Feb 15 '17 at 13:22

Compare-Object Find Matches and Remove Found from First Object

1 Answers1