Parsing PSCustomObject in PowerShell, Eventlogs

Question

So I am in need of some assistance. I got put on a project, involving writing a powershell script. And I need to be able to get the most recent SuccessAudit from the security log in a Windows 7 machine, ID=4776.

I managed to get this done in a couple of hours, it is my first time using powershell.

$eventtime=Get-EventLog Security | {$_.EventId -eq 4776} | where {$_.entrytype -eq "SuccessAudit"} | Select-Object TimeGenerated | Select -first 1

Output via console (w/o setting a variable):

TimeGenerated
--------------------------
4/10/2013 10:35:01 PM

If i set the command to a variable, this is the result of the variable:

@{TimeGenerated=4/10/2013 10:35:01 PM}

I would like to cut the variable so that it will only equal the date and time: 4/10/2013 10:35:01 PM

Help! I've been at it for hours!

CB. · Accepted Answer · 2013-04-11 06:04:43Z

2

try:

$eventtime=Get-EventLog Security | ? {$_.EventId -eq 4776} | 
where {$_.entrytype -eq "SuccessAudit"} | 
Select-Object -expand TimeGenerated | Select -first 1

answered Apr 11, 2013 at 6:04

CB.

61.3k9 gold badges171 silver badges165 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AnneTheAgile Over a year ago

@CB., this worked for me, too, ty! By just doing Select-Object -Property I got an array (Object[]) of PSCustomObject , and by changing to use -ExpandProperty instead I got the array of items I desired.

CB. Over a year ago

@AnneTheAgile Good! Glad to help again ;)

Collectives™ on Stack Overflow

Parsing PSCustomObject in PowerShell, Eventlogs

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related