none
How to convert XML to text string RRS feed

  • Question

  • The following script produces the output shown below. I need to convert that output to a text string so I can split the output and work with the %% part. How do I do that?

    $Event = Get-WinEvent -FilterHashtable @{Logname='microsoft-windows-backup';Id=14} -MaxEvents 1
    # Convert the event to XML
    $eventXML = [xml]$Event.ToXml()
    $eventxml.Event.EventData.Data  | Where-Object {$_.name -eq "Errormessage"}

    Output:

    Name         #text       
    ----         -----       
    ErrorMessage %%2155348327

    Thursday, April 26, 2018 3:36 PM

Answers

  • This gets the XML for the hidden nodes:

    $event.Event.EventData.Data | where{$_.Name -eq 'BackupWriteEndTime'} |select -expand '#text'


    \_(ツ)_/


    • Edited by jrv Thursday, April 26, 2018 9:19 PM
    • Marked as answer by azidct Friday, April 27, 2018 1:03 PM
    • Unmarked as answer by azidct Friday, April 27, 2018 1:05 PM
    • Marked as answer by azidct Friday, April 27, 2018 1:10 PM
    Thursday, April 26, 2018 9:19 PM

All replies

  • $data = $eventxml.Event.EventData.Data  | Where-Object {$_.name -eq "Errormessage"}
    $data.'#text'


    \_(ツ)_/

    Thursday, April 26, 2018 6:55 PM
  • Great that works for me. Thanks a bunch

    Now how do I get the date out of this

    $eventxml.Event.EventData.Data | Where-Object {$_.name -eq "Backupwriteendtime"}

    Output: I notice the output is truncated don't know if thats a problem or not. I need "2018-04-20"

    BackupWriteEndTime <TimesList><Time Time="2018-04-20T19:48:55.083Z" /><Time Time="1601-01-01T00:00:00.0...

    If I can get this I will be able to sleep tonight and put powershell back on the shelf.

    Thursday, April 26, 2018 8:43 PM
  • You have to extract it.  It is stored as an XML string inside of the Data object.  Extract and convert the text to XML then extract the "Time" elements "#text" nodes.


    \_(ツ)_/

    Thursday, April 26, 2018 9:07 PM
  • This gets the XML for the hidden nodes:

    $event.Event.EventData.Data | where{$_.Name -eq 'BackupWriteEndTime'} |select -expand '#text'


    \_(ツ)_/


    • Edited by jrv Thursday, April 26, 2018 9:19 PM
    • Marked as answer by azidct Friday, April 27, 2018 1:03 PM
    • Unmarked as answer by azidct Friday, April 27, 2018 1:05 PM
    • Marked as answer by azidct Friday, April 27, 2018 1:10 PM
    Thursday, April 26, 2018 9:19 PM
  • Look closely at the XML structure to see how it stores the data,

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Backup" Guid="{1DB28F2E-8F80-4027-8C5A-A11F7F10F62D}" />
        <EventID>14</EventID>
        <Version>2</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>2</Opcode>
        <Keywords>0x4000000000000000</Keywords>
        <TimeCreated SystemTime="2016-12-18T23:41:09.006400300Z" />
        <EventRecordID>1912</EventRecordID>
        <Correlation />
        <Execution ProcessID="4740" ThreadID="5704" />
        <Channel>Microsoft-Windows-Backup</Channel>
        <Computer>SBS01.KAHLNET.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="BackupTemplateID">{2FF416FA-F2A7-4694-BDAA-625D1C311E4F}</Data>
        <Data Name="HRESULT">0</Data>
        <Data Name="BackupState">14</Data>
        <Data Name="BackupTarget">E:</Data>
        <Data Name="NumOfVolumes">2</Data>
        <Data Name="BackupTime">2016-12-18T18:18:02.460077300Z</Data>
        <Data Name="HRESULT2">0</Data>
        <Data Name="VolumesInfo">&lt;VolumeInfo&gt;&lt;VolumeInfoItem Name="System Reserved" OriginalAccessPath="" State="14" HResult="0" DetailedHResult="0" PreviousState="9" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="1" FullBackupReason="3" DataTransferred="36241408" NumUnreadableBytes="0" TotalSize="36241408" TotalNoOfFiles="0" Flags="554" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /&gt;&lt;VolumeInfoItem Name="C:" OriginalAccessPath="C:" State="14" HResult="0" DetailedHResult="0" PreviousState="9" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="1" FullBackupReason="3" DataTransferred="484061675520" NumUnreadableBytes="0" TotalSize="484061675520" TotalNoOfFiles="0" Flags="1576" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /&gt;&lt;/VolumeInfo&gt;</Data>
        <Data Name="DetailedHRESULT">0</Data>
        <Data Name="SourceSnapStartTime">2016-12-18T18:18:02.444476600Z</Data>
        <Data Name="SourceSnapEndTime">2016-12-18T18:19:24.332550900Z</Data>
        <Data Name="PrepareBackupStartTime">&lt;TimesList&gt;&lt;Time Time="2016-12-18T18:19:26.953Z" /&gt;&lt;Time Time="2016-12-18T18:19:33.552Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="PrepareBackupEndTime">&lt;TimesList&gt;&lt;Time Time="2016-12-18T18:19:27.125Z" /&gt;&lt;Time Time="2016-12-18T18:19:34.301Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="BackupWriteStartTime">&lt;TimesList&gt;&lt;Time Time="2016-12-18T18:19:27.125Z" /&gt;&lt;Time Time="2016-12-18T18:19:34.301Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="BackupWriteEndTime">&lt;TimesList&gt;&lt;Time Time="2016-12-18T18:19:33.552Z" /&gt;&lt;Time Time="2016-12-18T23:40:43.468Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="TargetSnapStartTime">2016-12-18T23:41:00.223206200Z</Data>
        <Data Name="TargetSnapEndTime">2016-12-18T23:41:05.153027400Z</Data>
        <Data Name="DVDFormatStartTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>
        <Data Name="DVDFormatEndTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>
        <Data Name="MediaVerifyStartTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>
        <Data Name="MediaVerifyEndTime">&lt;TimesList&gt;&lt;/TimesList&gt;</Data>
        <Data Name="BackupPreviousState">11</Data>
        <Data Name="ComponentStatus">&lt;ComponentStatus&gt;&lt;/ComponentStatus&gt;</Data>
        <Data Name="SSBEnumerateStartTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SSBEnumerateEndTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SSBVhdCreationStartTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SSBVhdCreationEndTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SSBBackupStartTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SSBBackupEndTime">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="SystemStateBackup">&lt;SystemState IsPresent="0" HResult="0" DetailedHResult="0" /&gt;</Data>
        <Data Name="BMR">true</Data>
        <Data Name="VssFullBackup">false</Data>
        <Data Name="UserInputBMR">true</Data>
        <Data Name="UserInputSSB">false</Data>
        <Data Name="BackupSuccessLogPath">
        </Data>
        <Data Name="BackupFailureLogPath">
        </Data>
        <Data Name="EnumerateBackupStartTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="EnumerateBackupEndTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="PruneBackupStartTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>
        <Data Name="PruneBackupEndTime">&lt;TimesList&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;Time Time="1601-01-01T00:00:00.000Z" /&gt;&lt;/TimesList&gt;</Data>
      </EventData>
    </Event>

    Notice that all of the time data is stored as "stirngified" xml that can then be converted to an XML object.


    \_(ツ)_/

    Thursday, April 26, 2018 9:25 PM
  • This probably wasn't the cleanest way but it worked for me

    I just used $<item>.substring(indx, length)

    thanks all for your help

    I'm outa here

    Friday, April 27, 2018 1:10 PM