如何減少powershell命令的輸出？

Question

我有一個將數據寫入MS SQL數據庫的powershell腳本。 我使用命令get-winevent。

行Message很長，並且不包括所需的數據e.q. SID等。

如何切斷此命令的輸出？

更新

的代碼片段看起來像：

$events = Get-WinEvent @{LogName = "System"; ID = 4726} | select LevelDisplayName, LogName, TaskDisplayName, TimeCreated,@{N='Message';E={ 
$m = [regex]::Match($_.Message, '.*Account Name: (?<account>[^ ]*).*Account Domain: (?<domain>[^ ]*).*') 
"Account Name: $($m.Groups['account']) Account Domain: $($m.Groups['domain'])" 
}} 

$events 

在控制檯輸出看起來像：

LevelDisplayName：信息
LOGNAME：安全
TaskDisplayName：用戶帳戶管理
TimeCreated：2016年7月18日十一時55分42秒
消息：賬戶名稱：username_xxx帳戶域：

你怎麼能在Account Name:和值是一些空的影響之間看到。我怎樣才能忽略這種空洞的影響？

Answer 1

您可能會使用Substring。

Get-WinEvent ... | 
    Select-Object TimeCreated, @{n='Message';e={ 
     if ($_.Message.Length -gt 500) { 
      $_.Message.Substring(0, 500) 
     } else { 
      $_.Message 
     } 
    }} 

試圖挑選出句子。這將重新彙編消息中的第一個和第五個句子。如果第五個是空白的，你只能得到第一個。修剪用於清除不必要的新行。

Get-WinEvent ... | 
    Select-Object TimeCreated, @{n='Message';e={ 
     $message = $_.Message -split '\. ' 
     ($message[0] + "`r`n" + $message[4]).Trim() 
    }} 

Answer 2

試試這個：

Get-WinEvent | select TimeCreated,@{N='Message';E={ 
    $split = $_.Message.Split('. '); 
    if ($split.Length -gt 4){ 
    [string]::Join('. ', ($split[0], $split[4])) 
    } else { 
    $_.Message 
    } 
}} 

根據您的更新：

Get-WinEvent | select TimeCreated,@{N='Message';E={ 
    $m = [regex]::Match($_.Message, '.*Account Name: (?<account>[^ ]*).*Account Domain: (?<domain>[^ ]*).*') 
    "Account Name: $($m.Groups['account']) Account Domain: $($m.Groups['domain'])" 
}} 

測試用例：

$arg = [PSCustomObject]@{TimeCreated=Get-Date;Message="A user account was deleted. Subject: Security ID: SID_xxx Account Name: username_xxx Account Domain: domain_xxxx Logon ID: Target Account: Security ID: SID_xxx Account Name: name_xxx Account Domain: domain_xxx Additional Information: Privileges"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="A user account was deleted. Subject: Security ID: MySecurityID Account Name: myusername Account Domain: mydomain Logon ID: 0x30ffebc Target Account: Security ID: my securityid Account Name: myusername Account Domain: mydomain Additional Information: Privileges"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="Account Domain: myuserdomain"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="Account Name: myusername"} 

$arg | select TimeCreated,@{N='Message';E={ 
    $n = [regex]::Match($_.Message, '.*Account Name: ([^ $]*).*') 
    $d = [regex]::Match($_.Message, '.*Account Domain: ([^ $]*).*') 
    $result = if ($n.Success) { "Account Name: $($n.Groups[1])" } 

    if ($d.Success){ 
    if ($result) { $result += " Account Domain: $($d.Groups[1])" } 
    else { $result = "Account Domain: $($d.Groups[1])" } 
    } 
    $result 
}} 

返回：

TimeCreated   Message           
-----------   -------           
2016-08-30 08:03:57 Account Name: name_xxx Account Domain: domain_xxx 
2016-08-30 08:03:57 Account Name: myusername Account Domain: mydomain 
2016-08-30 08:03:57 Account Domain: myuserdomain      
2016-08-30 08:03:57 Account Name: myusername