Search String from a variable using Powershell

Question

I am trying to Search a String from a Variable.

I am dumping Azure Activity Logs in a variable and trying to find a specific line for that log. Here is my codes below.

$log=Get-AzLog -ResourceId "/subscriptions/SubscriptionID/resourceGroups/ResourceGroupName/providers/Microsoft.Sql/servers/qcsqldw/databases/DatabaseName" -StartTime 2020-04-01T00:30 
$find=$log | Select-String  -Pattern 'Microsoft.Sql/servers/databases/resume/action' 
Write-Output $find

I am trying to Search this Line "Action : Microsoft.Sql/servers/databases/resume/action" from the Log

While running the above script I did not got any output.

Please help me on this.

You want to find /pause yet your code shows you wanting to match /resume. Since -pattern uses regex matching, you don't need surrounding * characters because * is not a wildcard. The beginning * should throw an error since in regex * is a quantifier and there is nothing to quantify. — AdminOfThings
– AdminOfThings, Commented Apr 1, 2020 at 17:41
Hi AdminOfThings, Thanks for your comments. I have made the changes — Baxy
– Baxy, Commented Apr 1, 2020 at 18:03

RoadRunner · Accepted Answer · 2020-04-01 18:11:03Z

1

It seems you are searching the the Authorization Action property from your Azure Activity resource logs. If this is the case then you don't need to do any string searching, and simply reference the Authorization.Action property. Get-AzLog will give you a System.Object[], which can just be queried normally with Foreach-Object or Where-Object. You can find out this type information with (Get-AzLog).GetType().FullName.

You could run this query to get all your results with Foreach-Object:

Get-AzLog -ResourceId $id -StartTime 2020-04-01T00:30 | ForEach-Object {$_.Authorization.Action}

Which will give you the Authorization.Action property from all your logs that ran from the start time 2020-04-01T00:30.

If you want to modify this query to search for a specific action, you can filter with Where-Object, then select Authorization.Action from the results:

(Get-AzLog -ResourceId $id -StartTime 2020-04-01T00:30 | Where-Object {$_.Authorization.Action -eq "Microsoft.Sql/servers/databases/resume/action"}).Authorization.Action

edited Apr 1, 2020 at 18:11

answered Apr 1, 2020 at 17:49

RoadRunner

26.4k6 gold badges46 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Baxy Over a year ago

Hi RoadRunner, this solution helps a lot. Now I am able to search the log file.

RoadRunner Over a year ago

@Baxy I'm glad I could help :)

Collectives™ on Stack Overflow

Search String from a variable using Powershell

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related