I am trying to get a count of events in the event log, using the following:
get-eventlog application -Entrytype Error -After (Get-Date).AddDays(-7) | group-object -property eventID, source, message
However, because there is a timestamp in the message of some of the event messages, they don't group properly. (OK technically they "do" group properly, but I want a count of all of them.)
Too give an example, there is this error:
3221241857 Failed to schedule Software Protection service for re-start at 2113-09-21T21:37:24Z. Error Code: 0x80041316.
I want to group all of these so that I get a count of all of these on one line, rather than a line for each error as it is treating the message as unique because the timestamp differs.
Can I remove the timestamp with a regular expression or something? Not sure how to do that in PS.
Just to illustrate this, I currently get:
Name : 489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because
it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).
Count : 12
Group : {System.Diagnostics.EventLogEntry}
Values : {489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because
it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).}
Name : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316.
Count : 1
Group : {System.Diagnostics.EventLogEntry}
Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316.}
Name : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316.
Count : 1
Group : {System.Diagnostics.EventLogEntry}
Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316.}
But the bottom errors should be grouped together.
You can add a property just for grouping:
get-eventlog application -Entrytype Error -After (Get-Date).AddDays(-7) |
foreach { $_ | Add-Member Noteproperty -Name GrpMsg -Value ($_.Message -replace '[0-9T:-]+z','') -PassThru} |
group-object -property eventID, source, GrpMsg
User contributions licensed under CC BY-SA 3.0