Format PowerShell Outputs with Custom Fields

Question

I am a little new to PowerShell and am having trouble properly formatting the output of a script I am writing.

The first line of the snippet returns an array of objects of what I'm looking to format (Event ID 372 in the Printer's Event log). The second line prints out the properties I need for the object in position 3:

$error_372 = Get-WinEvent -LogName 'Microsoft-Windows-PrintService/Admin'| ? {$_.Id -eq '372'}
$error_372[3].Properties[0,1,2,4]

The output of the above returns the following:

Value                                                     
-----                                                     
Print Document                                            
Ahmet                                                     
Canon MP560 series Printer                                
131072

I want all of the objects returned in a format like this:

Document Name        User Name        Printer Name        Document Size 
-------------        ---------        ------------        -------------
Print Document        Ahmet           Canon MP560...      131072
 yada yada            yada             yada                yada

Ultimately, I need this in a CSV but figured I would start with trying to print it on the screen properly.

Shay Levy · Accepted Answer · 2012-12-17 06:42:32Z

1

You can also use the New-Object cmdlet (instead of multiple Add-Member calls):

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PrintService/Admin'; Id=372} | Foreach-Object{

    New-Object PSObject -Property @{
        DocumentName = $_.Properties[0].Value
        UserName = $_.Properties[1].Value       
        PrinterName = $_.Properties[2].Value
        DocumentSize = $_.Properties[4].Value
    }

}

edited Dec 17, 2012 at 6:42

answered Dec 16, 2012 at 7:12

Shay Levy

128k34 gold badges193 silver badges210 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Progger Over a year ago

I like this method better but the return outputs look like: System.Diagnostics.Ev... rather than the actual data. Do you know what I am doing wrong?

Progger Over a year ago

I appended ".value" after $_.Properties[0] and all is good. Thanks!

manojlds · Accepted Answer · 2012-12-15 19:31:56Z

1

You can construct the objects needed like so:

$error_372 | % { 
    $out =  new-object psobject;
    $out | add-member -Type noteproperty -Name "Document Name" -Value $_.Properties[0];
    $out | add-member -Type noteproperty -Name "User Name" -Value $_.Properties[1]
    $out | add-member -Type noteproperty -Name "Printer Name e" -Value $_.Properties[2]
    $out | add-member -Type noteproperty -Name "Document Size" -Value $_.Properties[4] -PassThru 
}

Note the -PassThru on the last Add-Member line which returns the object constructed to the pipeline.

answered Dec 15, 2012 at 19:31

manojlds

303k66 gold badges482 silver badges426 bronze badges

2 Comments

Progger Over a year ago

When I try doing what you suggested, this is the output:

Frode F. Over a year ago

you need to catch it with a pipeline and save, or create an array first $array = @() and add this line at the end of the foreachloop $array += $out (instead of -passthru).

CB. · Accepted Answer · 2012-12-15 20:21:15Z

try this:

$error_372 | % { 
    $out =  new-object psobject;
    $out | add-member -Type noteproperty -Name "Document Name" -Value ($_.Properties[0] | select -expa value)
    $out | add-member -Type noteproperty -Name "User Name" -Value ($_.Properties[1] | select -expa value)
    $out | add-member -Type noteproperty -Name "Printer Name e" -Value ($_.Properties[2]| select -expa value)
    $out | add-member -Type noteproperty -Name "Document Size" -Value ($_.Properties[4] | select -expa value) -PassThru 
}

or better:

$error_372 | % { 
    $out =  new-object psobject;
    $out | add-member -Type noteproperty -Name "Document Name" -Value ($_.Properties[0].value)
    $out | add-member -Type noteproperty -Name "User Name" -Value ($_.Properties[1].value)
    $out | add-member -Type noteproperty -Name "Printer Name e" -Value ($_.Properties[2].value)
    $out | add-member -Type noteproperty -Name "Document Size" -Value ($_.Properties[4].value) -PassThru 
}

Frode F. · Accepted Answer · 2012-12-16 14:38:37Z

You can create a custom PSobject with the properties you need(documentname, username ...) for each event. Fill in the properties with the values from event-objects. Collect them in an array and export to csv. Creation of custom objects is explained here

$array = @()

$error_372 | % { 
$out =  new-object psobject;
$out | add-member -NotePropertyName "Document Name" -NotePropertyValue ($_.Properties[0].value)
$out | add-member -NotePropertyName "User Name" -NotePropertyValue ($_.Properties[1].value)
$out | add-member -NotePropertyName "Printer Name" -NotePropertyValue ($_.Properties[2].value)
$out | add-member -NotePropertyName "Document Size" -NotePropertyValue ($_.Properties[4].value)
$array += $out
}

$array | export-csv -path events.csv

EDIT: -Noteproperty... parameters requires PS3.0 it seems.

Collectives™ on Stack Overflow

Format PowerShell Outputs with Custom Fields

4 Answers 4

2 Comments

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related