0

When I run this function without specifying the Count Parameter, it asks for the Source, which is expected, then doesn't return the information that the Count switch should return, but if I specify the Count Switch it returns the information I requested.

function Get-EventCounts
{
[CmdletBinding(DefaultParameterSetName = "Count")]
param (
    [Parameter(ParameterSetName = "Count", Mandatory = $false)]
    [Switch]$Count,
    [Parameter(ParameterSetName = "Message", Mandatory = $false)]
    [Switch]$Message,
    [Parameter(ParameterSetName = "Message", Mandatory = $true)]
    [String]$EventID,
    [Parameter(ParameterSetName = "Message", Mandatory = $true)]
    [Parameter(ParameterSetName = "Count", Mandatory = $true)]
    [String]$Source,
    [String[]]$DaysBack = ("7", "30", "60")
)

If ($Message)
{
    foreach ($int in $DaysBack)
    {
        $EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
        $MessageReturn = $EventList | Sort-Object -Property EventID | Where-Object -Property EventID -EQ $EventID
    }
    Return $MessageReturn.Message | Select-Object -Unique
}

If ($Count)
{
    foreach ($int in $DaysBack)
    {
        $EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message

        $UniqueID = $EventList.EventID | Sort | Get-Unique

        foreach ($Event in $UniqueID)
        {
            $Counting = $EventList | Where-Object -Property EventID -Like $Event

            $EventArray += @(
                [PSCustomObject]@{
                    EventID = $Event; TimeFrame = $int; Rate = $Counting.Count; PossibleMessage = $($($eventlist | where-object { $_.EventID -eq $event }))[0].Message
                }
            )
        }
    }
    Return $EventArray
}

}

Nick Pope
  • 37
  • 1
  • 1
  • 5
  • There is nothing in $Count in the scenario you describe. It has mandatory set to false, hence only $Source has content and the if statement never fires. – Axel Andersen Jun 06 '19 at 19:26

1 Answers1

0

It seems like you are trying to execute code based on the parameter set name rather than when switches are used. If that is the case, then you can change your if statement conditions.

function Get-EventCounts
{
[CmdletBinding(DefaultParameterSetName = "Count")]
param (
    [Parameter(ParameterSetName = "Count", Mandatory = $false)]
    [Switch]$Count,
    [Parameter(ParameterSetName = "Message", Mandatory = $false)]
    [Switch]$Message,
    [Parameter(ParameterSetName = "Message", Mandatory = $true)]
    [String]$EventID,
    [Parameter(ParameterSetName = "Message", Mandatory = $true)]
    [Parameter(ParameterSetName = "Count", Mandatory = $true)]
    [String]$Source,
    [String[]]$DaysBack = ("7", "30", "60")
)

If ($PSCmdlet.ParameterSetName -eq "Message")
{
    foreach ($int in $DaysBack)
    {
        $EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
        $MessageReturn = $EventList | Sort-Object -Property EventID | Where-Object -Property EventID -EQ $EventID
    }
    Return $MessageReturn.Message | Select-Object -Unique
}

If ($PSCmdlet.ParameterSetName -eq "Count")
{
    foreach ($int in $DaysBack)
    {
        $EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message

        $UniqueID = $EventList.EventID | Sort | Get-Unique

        foreach ($Event in $UniqueID)
        {
            $Counting = $EventList | Where-Object -Property EventID -Like $Event

            $EventArray += @(
                [PSCustomObject]@{
                    EventID = $Event; TimeFrame = $int; Rate = $Counting.Count; PossibleMessage = $($($eventlist | where-object { $_.EventID -eq $event }))[0].Message
                }
            )
        }
    }
    Return $EventArray
}
}

If you truly are trying to make decisions based off of the switches, then you would need to set a default value for $Count or add additional logic for when $Count is not present.

AdminOfThings
  • 23,946
  • 4
  • 17
  • 27