0

I have a powershell script that returns lines whose info will be ingested by Splunk in order to monitor DHCP Free Addresses.

The output is already heavily "treated", it looks like this (the &&& is a Splunk event breaker):

Subnet=10.31.3.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.4.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.9.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.32.1.0
AddressesInUse=32
AddressesFree=177
&&&
Subnet=10.34.1.0
AddressesInUse=98
AddressesFree=111
&&&

Though, I have a exception list with subnets values that must be ignored. I'm planing to write them to a text file, Get-Content from it, and replace the Subnet values in the variable (from the command result) that are -eq to any of the text file lines, turning it to "" (and then I'm planing to ignore them in Splunk with "IfNull(SubnetValue) then ignore event").

The expected results should look like this:

File SubnetExceptions.txt content example:

10.32.1.0
10.34.1.0

Expected result:

Subnet=10.31.3.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.4.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=10.31.9.0
AddressesInUse=0
AddressesFree=249
&&&
Subnet=
AddressesInUse=32
AddressesFree=177
&&&
Subnet=
AddressesInUse=98
AddressesFree=111
&&&

So that the ones that I wanted to ignore would come off as "null" values to Splunk, solving my problem :)

I've done a bit of replacing in my life, but never from a text file. My tests failed miserably. Could anyone help me to do it?

Thanks!

  • David

3 Answers 3

1

This code will join your ip in regex format to replace the ip

"$((Get-Content 'C:\Vincent\Test\IP.txt') -join '$|')$"
10.32.1.0$|10.34.1.0$  

or

"Subnet=$((Get-Content 'C:\Vincent\Test\IP.txt') -join '$|Subnet=')$",'Subnet='
Subnet=10.32.1.0$|Subnet=10.34.1.0$

Code to replace IP:

(Get-Content 'C:\Vincent\Test\Test.txt') -replace "$((Get-Content 'C:\Vincent\Test\IP.txt') -join '$|')$`"

or

(Get-Content 'C:\Vincent\Test\Test.txt') -replace "Subnet=$((Get-Content 'C:\Vincent\Test\IP.txt') -join '$|Subnet=')$",'Subnet='
Sign up to request clarification or add additional context in comments.

Comments

1

Something like this?

$ExceltpionList=get-content C:\temp\SubnetExceptions.txt

Get-Content C:\temp\spunkfile.txt | %{

$CurrentRow=$_

$ExceltpionList | %{

    if ($CurrentRow -eq "Subnet=$_")
    {
        $CurrentRow=$CurrentRow -replace "Subnet=$_", "Subnet="

    }
}

$CurrentRow

}

Comments

0

Provided your output is in a file result.txt you can do this:

$content = Get-Content "result.txt"
cat "subnetexceptions.txt" | %{ $content = $content -replace $_,"IGNORE"} 

If you need to save to file just add

$content > newfile.txt

I tested it and it works.

3 Comments

Thanks for the answer. I don't think I got it haha. Let me show you how I am doing this: > Out-File -InputObject $Result -filepath "c:\Scripts\Result.txt" > Get-Content "c:\Scripts\Result.txt" | cat SubnetExceptions.txt | %{ $Subnet = $_; | {$_ -replace $Subnet,"IGNORE"} }
Also tried with the variable itself, without outputting it into a "result" file.
I've edited my answer. The first one was a little hasty.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.