read userinput and pass to Get-EventLog function

Question

Please suggest the way forward for this, similarly I have to do for enddate, username etc. sample:

$StartDate, $String = "", ""

$StartDate = Read-Host -Prompt 'Enter the start date of the logs, Ex: 17/07/2017 09:00:00 '

if ($StartDate -and ( $StartDate -ne " ") -and ($StartDate -ne "")) {
    $StartDate = $StartDate -replace "`t|`n|`r", ""
    $String += " -After '$StartDate'"
} else {
    'You did not enter a valid Start date!'
}
echo "Get-EventLog -LogName Application $String"

Get-EventLog -LogName Application $String

Output:

Get-EventLog -LogName Application  -After '19/07/2017'
Get-EventLog : Cannot bind parameter 'InstanceId'. Cannot convert value
" -After '19/07/2017'" to type "System.Int64". Error: "Input string was not
in a correct format."
At C:\Users\kumars2\Downloads\Santosh\Powershell scripts\Enhancements\View logs examples\small_test.ps1:17 char:13
+ Get-EventLog <<<<  -LogName Application $String
    + CategoryInfo          : InvalidArgument: (:) [Get-EventLog], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.PowerShell.Commands.GetEventLogCommand

Please try to spend some more time to write an actual question. "Please suggest the way forward for this, similarly..." is not clear at all, and it's really difficult to figure out what you're actually asking. — James Z, Jul 19 '17 at 17:02

Ansgar Wiechers · Accepted Answer · 2017-07-20T08:25:38.500

4

If you want to construct a parameter list for a cmdlet you should use splatting instead of building (partial) string commandlines. You're getting the error you observed because PowerShell passes the entire string " -After '$StartDate'" as an argument to the parameter -InstanceId. Also, your date string has the format dd/MM/yyyy. PowerShell can't automagically convert this string to a DateTime value, so you need to do that yourself.

$culture = [Globalization.CultureInfo]::InvariantCulture
$pattern = 'dd\/MM\/yyyy'

$StartDate = $StartDate -replace '\s'  # remove all whitespace from date string
$EndDate   = $EndDate -replace '\s'    # remove all whitespace from date string

$params = @{
    'LogName' = 'Application'
}

if ($StartDate) {
    $params['After'] = [DateTime]::ParseExact($StartDate, $pattern, $culture)
}
if ($EndDate) {
    $params['Before'] = [DateTime]::ParseExact($EndDate, $pattern, $culture)
}

Get-EventLog @params

edited Jul 20 '17 at 08:25

answered Jul 19 '17 at 15:21

Ansgar Wiechers

193,178
25
254
328

Thank you its working.. can you suggest to enhance the script to take values only if given by user , EX: user gave input to only StartDate (in dd/MM/yyyy or /dd/MM/yyyy HH:MM:SS) and not EndDate, how to skip this in params – San Jul 20 '17 at 08:02
Thanks a lot.. its working now with date I. I need with date or datetime – San Jul 20 '17 at 08:51
@San Adjust the [pattern](https://learn.microsoft.com/en-us/dotnet/standard/base-types/custom-date-and-time-format-strings) accordingly. If you're expecting a turnkey solution: that's not going to happen. – Ansgar Wiechers Jul 20 '17 at 08:55
Ok, i will change pattern for date, can you suggest, how to pass *$Message* like below example: Get-EventLog -LogName Application -After '18/07/2017' -before '20/07/2017' -Message "* Configuration *" – San Jul 20 '17 at 09:17
Please stop moving the target. Re-read my answer and it should be obvious what you need to do for adding another parameter to the `$params` hashtable. – Ansgar Wiechers Jul 20 '17 at 09:20
Thanks a lot, i haven't looked it, its working now... I am getting the output You are really helpful – San Jul 20 '17 at 09:27

score 1 · Answer 2 · answered Jul 19 '17 at 15:11

I'm not 100% sure what you are doing with some of the code bouncing around up there but this works without issue assuming the date is valid:

$After = read-host
Get-EventLog -LogName Application -After $After

You can validate your input like this:

$After = read-host
if ($After -as [DateTime]) {
Get-EventLog -LogName Application -After $After
} else {
    Write-Host "Your input is not a valid date"
}

read userinput and pass to Get-EventLog function

2 Answers2