Extract specific text from powershell output

Question

Am novice with PS Scripting and am looking for assistance for the below requirement for Dell Servers:

Read the System Event logs for Event ID 2048, Extract the Time the even was generated, Physical Disk Number on specific RAID controller.

For Example:

Get-WinEvent -FilterHashtable @{logname='System' ; id=2048} -MaxEvents 1

Returns Output:

ProviderName: Server Administrator

TimeCreated Id LevelDisplayName Message 
----------- -- ---------------- ------- 
3/26/2018 1:18:51 AM 2048 Error Device failed: Physical Disk 0:0:13 Controller 0, Connector 0

I want to extract the disk and controller numbers along with the date in the following format:

**Disk-Failure, Date = 3/26/2018 1:18:51 AM , Physical Disk Number = 0:0:13 , Controller = 0 , Connector = 0**

Please assist.

Thank You.

Can you provide what you have tried so far? There are lots of similar text search/replacement questions here and on other sites. Keywords: replace, match, regex (if you want), string format — Frode F.
– Frode F., Commented Mar 30, 2018 at 16:36

lit · Accepted Answer · 2018-03-30 18:54:49Z

A regex might be a good way to approach this. It can select items out of the message property.

[regex]$rx = '.*Physical Disk (?<pd>.*) Controller (?<ctrl>.*), Connector (?<conn>.*).*'

Get-WinEvent -FilterHashtable @{logname='System' ; id=2048} -MaxEvents 1 |
    ForEach-Object {
        $r = $rx.Match($_.Message)
        $pd = $r.Groups['pd'].Value
        $ctrl = $r.Groups['ctrl'].Value
        $conn = $r.Groups['conn'].Value

        %{[string]::Format('**Disk-Failure, Date {0} , Physical Disk Number = {1} , Controller = {2} , Connector {3}', `
            $_.TimeCreated, $pd, $ctrl, $conn)}
    }

To test this, since I do not have any disk failures on my machine, I created an object with the properties that Get-WinEvent presented.

$properties = @{'TimeCreated'='3/26/2018 1:18:51 AM';
                'Id'=2018;
                'LevelDisplayName'='Error';
                'Message'= 'Device failed: Physical Disk 0:0:13 Controller 0, Connector 0'}
$object = New-Object -TypeName PSObject -Prop $properties

Collectives™ on Stack Overflow

Extract specific text from powershell output

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related