locked
-ExpandProperty & Export CSV RRS feed

  • Question

  • Hi Guys.

    Struggling with a script i am trying to knock together. I am trying to do the following

    1) Connect to a computer
    2) Search the Application EventLogs
    3) Looking for EventID 100
    4) Look for Outlook in the message body
    5) Export the Time, MachineName, and the full message.

    Now if i dont include | select -ExpandProperty message then the script runs fine but the message in the CSV is truncated. Any ideas on how i can get all the info in the CSV that i require.

    The script below.

    Get-EventLog -ComputerName PC-NAME-HERE -LogName Application -EntryType Error -Newest 100 `
    | Where-Object {$_.EventID -eq 1000} | Where {$_.message –match "Outlook"} `
    | Select-Object Timegenerated, EntryType, MachineName, Message | select -ExpandProperty message `
    | Export-Csv C:\NRTEcho\Script\Export.csv -NoTypeInformation -Append

    Thursday, October 22, 2015 2:57 PM

Answers

  • Are you sure it's truncated? I don't see the same behavior. What are you using to view the CSV? It is possible it's Excel and the column isn't expanded enough to see all the detail? Try opening the CSV with Notepad, or using Import-Csv -Path 'C:\NRTEcho\Script\Export.csv' to read it back in to PowerShell. Also, don't use a back tick (for line continuation) unless absolutely necessary. In your case, just use the pipeline:

    Get-EventLog -ComputerName PC-NAME-HERE -LogName Application -EntryType Error -Newest 100 |
        Where-Object {$_.EventID -eq 1000} | Where {$_.message –match "Outlook"} |
        Select-Object Timegenerated, EntryType, MachineName, Message |
        Export-Csv C:\NRTEcho\Script\Export.csv -NoTypeInformation -Append

    • Marked as answer by WallaceTech Thursday, October 22, 2015 3:31 PM
    Thursday, October 22, 2015 3:29 PM
  • This should get you the information you want using the basis of your existing script.  However, as jrv is pointing out, Get-WinEvent using a filter hash table is a lot more efficient and will reduce the network traffic when polling remote machines.

    $Events = Get-WinEvent -FilterHashtable @{LogName='Application'; ID=1000; Level=2} -ComputerName PC-NAME-HERE -MaxEvents 100 
    $objfull = @()
    
    Foreach ($Event in $Events)
            {
             $obj = New-Object System.Object
             $obj | Add-Member NoteProperty Time $Event.Timegenerated
             $obj | Add-Member NoteProperty Type $Event.EntryType
             $obj | Add-Member NoteProperty message $Event.message
             $objfull += $obj 
             }
    $objfull | Export-Csv C:\NRTEcho\Script\Export.csv -NoTypeInformation


    • Marked as answer by WallaceTech Thursday, October 22, 2015 4:17 PM
    • Edited by Tim E Lane Thursday, October 22, 2015 11:22 PM
    Thursday, October 22, 2015 3:30 PM

All replies

  • Thanks for the reply mate. My script works but i struggling with a specfic point. which is the CSV part when using -ExpandProperty.
    Thursday, October 22, 2015 3:25 PM
  • Are you sure it's truncated? I don't see the same behavior. What are you using to view the CSV? It is possible it's Excel and the column isn't expanded enough to see all the detail? Try opening the CSV with Notepad, or using Import-Csv -Path 'C:\NRTEcho\Script\Export.csv' to read it back in to PowerShell. Also, don't use a back tick (for line continuation) unless absolutely necessary. In your case, just use the pipeline:

    Get-EventLog -ComputerName PC-NAME-HERE -LogName Application -EntryType Error -Newest 100 |
        Where-Object {$_.EventID -eq 1000} | Where {$_.message –match "Outlook"} |
        Select-Object Timegenerated, EntryType, MachineName, Message |
        Export-Csv C:\NRTEcho\Script\Export.csv -NoTypeInformation -Append

    • Marked as answer by WallaceTech Thursday, October 22, 2015 3:31 PM
    Thursday, October 22, 2015 3:29 PM
  • You can't use expand property.  That is used for other things and not to output to  CSV.  Read the blog articles and all will become clear


    \_(ツ)_/


    • Edited by jrv Thursday, October 22, 2015 3:30 PM
    Thursday, October 22, 2015 3:29 PM
  • This should get you the information you want using the basis of your existing script.  However, as jrv is pointing out, Get-WinEvent using a filter hash table is a lot more efficient and will reduce the network traffic when polling remote machines.

    $Events = Get-WinEvent -FilterHashtable @{LogName='Application'; ID=1000; Level=2} -ComputerName PC-NAME-HERE -MaxEvents 100 
    $objfull = @()
    
    Foreach ($Event in $Events)
            {
             $obj = New-Object System.Object
             $obj | Add-Member NoteProperty Time $Event.Timegenerated
             $obj | Add-Member NoteProperty Type $Event.EntryType
             $obj | Add-Member NoteProperty message $Event.message
             $objfull += $obj 
             }
    $objfull | Export-Csv C:\NRTEcho\Script\Export.csv -NoTypeInformation


    • Marked as answer by WallaceTech Thursday, October 22, 2015 4:17 PM
    • Edited by Tim E Lane Thursday, October 22, 2015 11:22 PM
    Thursday, October 22, 2015 3:30 PM
  • I did some testing and your code works perfectly fine for me without the Select -ExpandProperty. I get the full message content in the CSV file.

    Get-EventLog -ComputerName PC-NAME-HERE -LogName Application -EntryType Error -Newest 100 `
     | Where-Object {$_.EventID -eq 1000} | Where {$_.message –match "Outlook"} `
     | Select-Object Timegenerated, EntryType, MachineName, Message `
     | Export-CSV test.csv -NoTypeInformation

    Thursday, October 22, 2015 3:30 PM
  • THanks mate.

    Yeah notepad views the data correctley. A different version of excel is also able to view the data as it should be. I need to expand the cells to see it all but its all there.

    Cheers for the help.

    Thursday, October 22, 2015 3:33 PM
  • Hey, you're very welcome. Glad I could help.
    Thursday, October 22, 2015 3:53 PM
  • Thank you.

    This does seem to run a little quicker.

    Thursday, October 22, 2015 4:18 PM