Powershell：函數參數

Question

我正在構建一個powershell函數，以便我可以查詢多臺計算機的事件日誌。我複製了下面的代碼，我需要幫助。如果我不發送eventID，我希望腳本找到所有事件ID，我如何實現這一點？

#this would be the parameter part of the script 
[String]$ComputerName = $env:COMPUTERNAME#Current computer 
[String[]]$EventLogNames=@("Application","System")#Main eventlogs 
[int[]]$EventIds = 1 #Event Ids 
[System.DateTime[]]$EventStartDate = (((Get-Date).addDays(-2)).date)#date 10 days ago 
[System.DateTime[]]$EventEndTime = (Get-Date)#date 10 days ago 

#This fits in the process section 
$EventCritea = @{logname = $EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime; ID=$EventIds} 
Get-WinEvent -ComputerName $ComputerName -FilterHashTable $EventCritea -ErrorAction SilentlyContinue 

Answer 1

首先，你的其他question修復的各類$EventStartDate和$EventEndTime。

對於這個問題：逐步建立哈希表：

$filter = @{logname = $EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime} 

if ($EventIds -ne $null -and $EventIds.Length -gt 0) { 
    $filter.ID=$EventIds 
} 

Get-WinEvent -ComputerName $ComputerName -FilterHashTable $filter #...