How can I group-objects in powershell that are *almost* the same?

1

I am trying to get a count of events in the event log, using the following:

get-eventlog application -Entrytype Error -After (Get-Date).AddDays(-7)  | group-object -property eventID, source, message

However, because there is a timestamp in the message of some of the event messages, they don't group properly. (OK technically they "do" group properly, but I want a count of all of them.)

Too give an example, there is this error:

3221241857 Failed to schedule Software Protection service for re-start at 2113-09-21T21:37:24Z. Error Code: 0x80041316.

I want to group all of these so that I get a count of all of these on one line, rather than a line for each error as it is treating the message as unique because the timestamp differs.

Can I remove the timestamp with a regular expression or something? Not sure how to do that in PS.

Just to illustrate this, I currently get:

    Name   : 489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because 
             it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).
    Count  : 12
    Group  : {System.Diagnostics.EventLogEntry}
    Values : {489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because 
             it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).}

    Name   : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316.
    Count  : 1
    Group  : {System.Diagnostics.EventLogEntry}
    Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316.}

    Name   : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316.
    Count  : 1
    Group  : {System.Diagnostics.EventLogEntry}
    Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316.}

But the bottom errors should be grouped together.

powershell
group-by
asked on Stack Overflow Oct 16, 2013 by Ben • edited Oct 16, 2013 by Ben

1 Answer

1

You can add a property just for grouping:

get-eventlog application -Entrytype Error -After (Get-Date).AddDays(-7)  |
 foreach { $_ | Add-Member Noteproperty -Name GrpMsg -Value ($_.Message -replace '[0-9T:-]+z','') -PassThru} |
 group-object -property eventID, source, GrpMsg
answered on Stack Overflow Oct 16, 2013 by mjolinor

User contributions licensed under CC BY-SA 3.0