如何减少powershell命令的输出？

Question

我有一个将数据写入MS SQL数据库的powershell脚本。 我使用命令get-winevent。

行Message很长，并且不包括所需的数据e.q. SID等。

如何切断此命令的输出？

更新

的代码片段看起来像：

$events = Get-WinEvent @{LogName = "System"; ID = 4726} | select LevelDisplayName, LogName, TaskDisplayName, TimeCreated,@{N='Message';E={ 
$m = [regex]::Match($_.Message, '.*Account Name: (?<account>[^ ]*).*Account Domain: (?<domain>[^ ]*).*') 
"Account Name: $($m.Groups['account']) Account Domain: $($m.Groups['domain'])" 
}} 

$events 

在控制台输出看起来像：

LevelDisplayName：信息
LOGNAME：安全
TaskDisplayName：用户帐户管理
TimeCreated：2016年7月18日十一时55分42秒
消息：账户名称：username_xxx帐户域：

你怎么能在Account Name:和值是一些空的影响之间看到。我怎样才能忽略这种空洞的影响？

Answer 1

您可能会使用Substring。

Get-WinEvent ... | 
    Select-Object TimeCreated, @{n='Message';e={ 
     if ($_.Message.Length -gt 500) { 
      $_.Message.Substring(0, 500) 
     } else { 
      $_.Message 
     } 
    }} 

试图挑选出句子。这将重新汇编消息中的第一个和第五个句子。如果第五个是空白的，你只能得到第一个。修剪用于清除不必要的新行。

Get-WinEvent ... | 
    Select-Object TimeCreated, @{n='Message';e={ 
     $message = $_.Message -split '\. ' 
     ($message[0] + "`r`n" + $message[4]).Trim() 
    }} 

Answer 2

试试这个：

Get-WinEvent | select TimeCreated,@{N='Message';E={ 
    $split = $_.Message.Split('. '); 
    if ($split.Length -gt 4){ 
    [string]::Join('. ', ($split[0], $split[4])) 
    } else { 
    $_.Message 
    } 
}} 

根据您的更新：

Get-WinEvent | select TimeCreated,@{N='Message';E={ 
    $m = [regex]::Match($_.Message, '.*Account Name: (?<account>[^ ]*).*Account Domain: (?<domain>[^ ]*).*') 
    "Account Name: $($m.Groups['account']) Account Domain: $($m.Groups['domain'])" 
}} 

测试用例：

$arg = [PSCustomObject]@{TimeCreated=Get-Date;Message="A user account was deleted. Subject: Security ID: SID_xxx Account Name: username_xxx Account Domain: domain_xxxx Logon ID: Target Account: Security ID: SID_xxx Account Name: name_xxx Account Domain: domain_xxx Additional Information: Privileges"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="A user account was deleted. Subject: Security ID: MySecurityID Account Name: myusername Account Domain: mydomain Logon ID: 0x30ffebc Target Account: Security ID: my securityid Account Name: myusername Account Domain: mydomain Additional Information: Privileges"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="Account Domain: myuserdomain"}, 
[PSCustomObject]@{TimeCreated=Get-Date;Message="Account Name: myusername"} 

$arg | select TimeCreated,@{N='Message';E={ 
    $n = [regex]::Match($_.Message, '.*Account Name: ([^ $]*).*') 
    $d = [regex]::Match($_.Message, '.*Account Domain: ([^ $]*).*') 
    $result = if ($n.Success) { "Account Name: $($n.Groups[1])" } 

    if ($d.Success){ 
    if ($result) { $result += " Account Domain: $($d.Groups[1])" } 
    else { $result = "Account Domain: $($d.Groups[1])" } 
    } 
    $result 
}} 

返回：

TimeCreated   Message           
-----------   -------           
2016-08-30 08:03:57 Account Name: name_xxx Account Domain: domain_xxx 
2016-08-30 08:03:57 Account Name: myusername Account Domain: mydomain 
2016-08-30 08:03:57 Account Domain: myuserdomain      
2016-08-30 08:03:57 Account Name: myusername