从文本文件修剪并导出到CSV powershell

Question

我目前已被分配了查找用户在我们的系统中登录的桌面的任务。我是相当新的PowerShell的，所以我在很长的职位和凌乱的脚本

还有就是将此信息成每当用户登录日志文件登录脚本道歉。如下所示。

Script started: 1/01/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   %username% 
Information : COMPUTERNAME:  %computername% 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 

我需要同时获得“启动脚本：2010年1月1日00:00:00”和“信息：计算机：％计算机％”，然后将这些零部件出口到CSV文件中。我可以得到信息使用

$Str ComputerName = Get-Content -Path %log%| Select-String "COMPUTERNAME:" 

为多个用户，这只是给了我登录到从日志文件中不是所有桌面的最后一台计算机。是否有办法获取所有计算机名称和脚本启动并将它们导出到CSV文件中单独的列中？也许更简单和更短的方式。

Foreach ($ObjCSVline in $(Import-csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogon.csv")) 
{ 
$strUsername = $ObjCSVline.Lastlogon 

try { 
$arrUserIdOutput = Get-ADUser $strUsername -Properties homedirectory | select * 
} catch { 
Write-Host "User: " $strUsername" Does not exist" 
} 

$strUserHomeDirectory = $arrUserIdOutput.HomeDirectory 
$strUserLogs = $strUserHomeDirectory + $strLogFile 

if ((Test-Path $strUserLogs) -eq $true) { 

    $strLogs = Get-Content $strUserLogs | Select-String "Script started:  " | Select-Object -Last 1 

    $Time = $strLogs -replace "Script started:  ","" 

    $StrComp = Get-Content $strUserLogs | Select-String "Information : COMPUTERNAME: " | Select-Object -Last 1 

    $computerID = $StrComp -replace "Information : COMPUTERNAME: ","" 

} else { $strUserLogs = $strUserLogs + $strOldLogFile 
    if ((Test-Path $strUserLogs) -eq $true) { 

    $strLogs = Get-Content $strUserLogs | Select-String "Script started: " | Select-Object -Last 1 

    $Time = $strLogs -replace "Script started: ","" 
    } else 
    { 
    Write-Host "unable to find log file for" $strUsername 
    } 
    } 

$objOutput.desktop = $computerID 
$objOutput.TimeOutput = $Time 
$objOutput.Username = $strUsername 
$objOutput | Select-Object Username,TimeOutput,desktop | Export-Csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation 
} 

Answer 1

因此，考虑到日志文件的格式，我会建议使用正则表达式匹配或者“脚本启动”或“信息：计算机名”或“信息：用户名：”。然后，对于每场比赛，我都会通过一个Switch来运行匹配，以将结果分配给$ LoginDate，$ UserName或$ ComputerName的适当变量。切换完成后，我检查是否记录了所有3个项目，如果是，则输出包含三个属性的自定义对象，并清除变量以设置下一个登录记录。这将做到这一点：

GC $strUserLogs|?{$_ -match "(Script started:\s*?|Information.+?: COMPUTERNAME:.\s*?|Information.+?: USERNAME:.\s*?)(\w.*)"}|%{ 
    Switch($Matches[1]){ 
     {$Matches[1] -like "Script Started*"}{$LoginDate = $Matches[2]} 
     {$Matches[1] -like "*USERNAME*"}{$UserName = $Matches[2]} 
     {$Matches[1] -like "*COMPUTERNAME*"}{$ComputerName = $Matches[2]} 
    } 
    If($LoginDate -and $UserName -and $ComputerName){ 
     [PSCustomObject]@{ 
      "Login Date"=$LoginDate 
      "Computer Name"=$ComputerName 
      "User Name"=$UserName 
     } 
    Remove-Variable LoginDate,ComputerName,UserName 
    } 
}|Sort "User Name","Login Date"|Export-CSV "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation 

最后我排序的用户，并通过日期，并出口到你在你的例子有日志文件。如果没有导出为CSV文件，只是让它输出到屏幕，我分析测试日志文件：

Script started: 1/01/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   JimBob 
Information : COMPUTERNAME:  DesktopA 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 
Script started: 1/02/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   MarySue 
Information : COMPUTERNAME:  LaptopB 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 
Script started: 1/03/2010 00:00:00 

Information : Script Ver:  1.05 
Information : LOGONSERVER:  %servername% 
Information : USERNAME:   JimBob 
Information : COMPUTERNAME:  ServerC 
Information : COMPUTER SITE: $location% 
Information : OS Version:  %system% 
Information : Domain:   %domain% 

它输出好听：

Login Date      Computer Name      User Name      
----------      -------------      ---------      
1/01/2010 00:00:00    ServerC       JimBob       
1/03/2010 00:00:00    LaptopB       JimBob       
1/02/2010 00:00:00    DesktopA       MarySue