Get-WinEvent中消息中的grep字符串

Question

我有一个脚本来检查事件日志从get-winevent，我需要显示的get-winevent输出的完整结果基于搜索字符串从消息列。

有没有办法在get-winevent中使用grep Message列

这是当前字符串

Get-WinEvent -ComputerName $Target_Machine -FilterHashtable $params

Answer 1

您可以通过管道将输出传递到Where-object，请参见下面的示例：

$SearchString="AutoConfig"                                                                                                                                                                             
Get-WinEvent Microsoft-Windows-WLAN-AutoConfig/Operational | Where-Object{$_.Message -like "*$SearchString*"}    

Answer 2

$SearchString="your sting"                                                                                                                                                                             
Get-WinEvent -FilterHashtable @{LogName='Security'} |Where-Object -Property Message -Match $SearchString

Get-WinEvent -FilterHashtable @{LogName='Application'} |Where-Object -Property Message -Match $SearchString

Get-WinEvent -FilterHashtable @{LogName='Setup'} |Where-Object -Property Message -Match $SearchString

Get-WinEvent -FilterHashtable @{LogName='System'} |Where-Object -Property Message -Match $SearchString