How to use a variable result in a match/select-string - Powershell

Question

I am looking through logfiles for which client holds an application session. This isn't logged clearly, so you have to first find the client number getting updates, then check the log again for which client was assigned the number.

I cannot complete this last step, when I include my found number in my match, or select-string I get not hits. Writing it plainly works.

Here's my process:

    $path1 = "\\path\previous\logfile\.log.1"
    $path2 = "\\path\current\logfile\*.log"
    $getLogContent = Get-Content $path1, $path2
    $stringToSplit =$getlogcontent.where({$_ -match "Sending device updates to client"}, 'Last')
    $client= $stringtosplit.split("#")
    $clientString = $client[1]
    $number= $clientstring.split(":")
    $finalSearch = "got client ID $number"
    $SessionOwner= $getlogcontent | Select-String $finalSearch -Context 3,0
    $sessionOwner

Here is my data:

PS:>$stringToSplit
2020-09-18 12:24:50,042 DEBUG P0000 [ApplicationSrv] [ApplicationFactory] Sending device updates to client #122:

What I'm trying to match against:

PS:>$SessionOwner= $getlogcontent.where({$_ -match "got client ID"})
$SessionOwner
2020-09-18 06:54:56,914 INFO  P0000 Application[Client 115 ] registered successfully, got client ID 115.
2020-09-18 06:58:05,109 INFO  P0000 Application[Client 116 ] registered successfully, got client ID 116.
2020-09-18 07:00:04,013 INFO  P0000 Application[Client 117 ] registered successfully, got client ID 117.
2020-09-18 07:06:37,101 INFO  P0000 Application[Client 118 ] registered successfully, got client ID 118.
2020-09-18 07:06:43,081 INFO  P0000 Application[Client 119 ] registered successfully, got client ID 119.
2020-09-18 07:11:19,963 INFO  P0000 Application[Client 120 ] registered successfully, got client ID 120.
2020-09-18 10:20:26,638 INFO  P0000 Application[Client 121 ] registered successfully, got client ID 121.
2020-09-18 10:43:57,085 INFO  P0000 Application[Client 122 ] registered successfully, got client ID 122.
2020-09-18 10:59:21,873 INFO  P0000 Application[Client 123 ] registered successfully, got client ID 123.
2020-09-18 11:23:31,339 INFO  P0000 Application[Client 124 ] registered successfully, got client ID 124.
2020-09-18 11:41:13,406 INFO  P0000 Application[Client 125 ] registered successfully, got client ID 125.
2020-09-18 12:14:23,370 INFO  P0000 Application[Client 126 ] registered successfully, got client ID 126.

I feel I've tried all kinds of joins, regex'es, "search text $varaible", 'search text'$variable and making a new complete $variable. I'm completely stumped as to how I can add the $number to my string and search for it.

score 1 · Accepted Answer · answered Sep 19 '20 at 01:57

The reason it's not working the way you expect is because this split

$number= $clientstring.split(":")

Actually outputs two lines

$number | foreach {"Line $_"}
Line 122
Line

You could grab the first element to correct it.

$number= $clientstring.split(":")[0]

$number | foreach {"Line $_"}
Line 122

However, I recommend simplifying your code a bit. This will do it in one shot

if($getLogContent.where({$_ -match '(?<=Sending device updates to client #)\d{3}'}, 'last'))
{
    $number = $matches.0
}

$number | foreach {"Line $_"}
Line 122

You didn't specify why you're grabbing the three lines above. However with that left in here is your code with my recommendation

$path1 = "\\path\previous\logfile\.log.1"
$path2 = "\\path\current\logfile\*.log"
$getLogContent = Get-Content $path1, $path2
if($getLogContent.where({$_ -match '(?<=Sending device updates to client #)\d{3}'}, 'last'))
{
    $number = $matches.0
}
$SessionOwner= $getlogcontent | Select-String "got client ID $number" -Context 3,0
$sessionOwner

Which outputs

  2020-09-18 07:06:43,081 INFO  P0000 Application[Client 119 ] registered successfully, got client ID 119.
  2020-09-18 07:11:19,963 INFO  P0000 Application[Client 120 ] registered successfully, got client ID 120.
  2020-09-18 10:20:26,638 INFO  P0000 Application[Client 121 ] registered successfully, got client ID 121.
> 2020-09-18 10:43:57,085 INFO  P0000 Application[Client 122 ] registered successfully, got client ID 122.

The reason I have the context is that the third line above "got client ID" contains the log entry for which client is applying for an ID, giving us the identity of the session holder. Thank you for your much more elegant approach, and solution. — Hargaut, Sep 21 '20 at 07:01
Glad to hear it helped. Please consider accepting the answer if it helped solve the issue and answered your question — Doug Maurer, Sep 21 '20 at 07:11
I just had to replace `\d{3}` with `\d+` since the number is dynamic from 1 to however many sign-in's they've had since last reset. — Hargaut, Sep 21 '20 at 08:23

How to use a variable result in a match/select-string - Powershell

1 Answers1