從文本文件修剪並導出到CSV powershell

Question

我目前已被分配了查找用戶在我們的系統中登錄的桌面的任務。我是相當新的PowerShell的，所以我在很長的職位和凌亂的腳本

還有就是將此信息成每當用戶登錄日誌文件登錄腳本道歉。如下所示。

Script started: 1/01/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   %username% 
Information : COMPUTERNAME:  %computername% 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 

我需要同時獲得「啓動腳本：2010年1月1日00:00:00」和「信息：計算機：％計算機％」，然後將這些零部件出口到CSV文件中。我可以得到信息使用

$Str ComputerName = Get-Content -Path %log%| Select-String "COMPUTERNAME:" 

爲多個用戶，這只是給了我登錄到從日誌文件中不是所有桌面的最後一臺計算機。是否有辦法獲取所有計算機名稱和腳本啓動並將它們導出到CSV文件中單獨的列中？也許更簡單和更短的方式。

Foreach ($ObjCSVline in $(Import-csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogon.csv")) 
{ 
$strUsername = $ObjCSVline.Lastlogon 

try { 
$arrUserIdOutput = Get-ADUser $strUsername -Properties homedirectory | select * 
} catch { 
Write-Host "User: " $strUsername" Does not exist" 
} 

$strUserHomeDirectory = $arrUserIdOutput.HomeDirectory 
$strUserLogs = $strUserHomeDirectory + $strLogFile 

if ((Test-Path $strUserLogs) -eq $true) { 

    $strLogs = Get-Content $strUserLogs | Select-String "Script started:  " | Select-Object -Last 1 

    $Time = $strLogs -replace "Script started:  ","" 

    $StrComp = Get-Content $strUserLogs | Select-String "Information : COMPUTERNAME: " | Select-Object -Last 1 

    $computerID = $StrComp -replace "Information : COMPUTERNAME: ","" 

} else { $strUserLogs = $strUserLogs + $strOldLogFile 
    if ((Test-Path $strUserLogs) -eq $true) { 

    $strLogs = Get-Content $strUserLogs | Select-String "Script started: " | Select-Object -Last 1 

    $Time = $strLogs -replace "Script started: ","" 
    } else 
    { 
    Write-Host "unable to find log file for" $strUsername 
    } 
    } 

$objOutput.desktop = $computerID 
$objOutput.TimeOutput = $Time 
$objOutput.Username = $strUsername 
$objOutput | Select-Object Username,TimeOutput,desktop | Export-Csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation 
} 

Answer 1

因此，考慮到日誌文件的格式，我會建議使用正則表達式匹配或者「腳本啓動」或「信息：計算機名」或「信息：用戶名：」。然後，對於每場比賽，我都會通過一個Switch來運行匹配，以將結果分配給$ LoginDate，$ UserName或$ ComputerName的適當變量。切換完成後，我檢查是否記錄了所有3個項目，如果是，則輸出包含三個屬性的自定義對象，並清除變量以設置下一個登錄記錄。這將做到這一點：

GC $strUserLogs|?{$_ -match "(Script started:\s*?|Information.+?: COMPUTERNAME:.\s*?|Information.+?: USERNAME:.\s*?)(\w.*)"}|%{ 
    Switch($Matches[1]){ 
     {$Matches[1] -like "Script Started*"}{$LoginDate = $Matches[2]} 
     {$Matches[1] -like "*USERNAME*"}{$UserName = $Matches[2]} 
     {$Matches[1] -like "*COMPUTERNAME*"}{$ComputerName = $Matches[2]} 
    } 
    If($LoginDate -and $UserName -and $ComputerName){ 
     [PSCustomObject]@{ 
      "Login Date"=$LoginDate 
      "Computer Name"=$ComputerName 
      "User Name"=$UserName 
     } 
    Remove-Variable LoginDate,ComputerName,UserName 
    } 
}|Sort "User Name","Login Date"|Export-CSV "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation 

最後我排序的用戶，並通過日期，並出口到你在你的例子有日誌文件。如果沒有導出爲CSV文件，只是讓它輸出到屏幕，我分析測試日誌文件：

Script started: 1/01/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   JimBob 
Information : COMPUTERNAME:  DesktopA 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 
Script started: 1/02/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   MarySue 
Information : COMPUTERNAME:  LaptopB 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 
Script started: 1/03/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   JimBob 
Information : COMPUTERNAME:  ServerC 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 

它輸出好聽：

Login Date      Computer Name      User Name      
----------      -------------      ---------      
1/01/2010 00:00:00    ServerC       JimBob       
1/03/2010 00:00:00    LaptopB       JimBob       
1/02/2010 00:00:00    DesktopA       MarySue