0

I am trying to extract some part of the message from the event log output.

I ran the below command:

$filterXml = ‘<QueryList>
  <Query Id="0" Path="atm">
    <Select Path="atm">*[System[(Level=2)]]</Select>
  </Query>
</QueryList>’

$event = Get-WinEvent –FilterXml $filterXml

I am using different methods to get the desired output required by running the below commands but none worked out properly. Maybe I did not try and worked out it perfectly.

$event.Message.Substring(56,139)
$event.Message.split(":")
$event = 
[int]($event.message | Select-String "jobId").Matches.Groups[2].Value

My output:

Message: Shell.SmartM.atm.Service.atmServiceException: {jobId:38895,name:All Reports: Kiran, Kumar,reportConfigurationId:1805
0,status:Error} --- Shell.SmartM.atm.Service.DataException: An error occurred while attempting to retrieve data from system. --- System.InvalidOperationException: Request to system failed with status code NotFound --- System.Exception: {Errors:[An exception has occurred. Please contact your 
System administrator for help in enabling debug mode.]} .....
App Domain: /LM/W3SVC/2/
ProcessId: 3696
Win32 ThreadId: 5536
Extended Properties:
  UserId: LOCALHOST

I am trying to get values from the above output for

jobid:
name:
Shell.SmartM.atm.Service.DataException:
System.InvalidOperationException:
System.Exception: {Errors:

0 Answers0