InputObject is null - Powershell DataTable - powershell

Question

I'm attempting to output an object array (of event logs) to a DataTable with the expectation to pipe into SQL.
The basics are:
Get some forwarded events
Process them to pull some required info out
Output to a data table
function Get-Type
{
param($type)
$types = #(
'System.Boolean',
'System.Byte[]',
'System.Byte',
'System.Char',
'System.Datetime',
'System.Decimal',
'System.Double',
'System.Guid',
'System.Int16',
'System.Int32',
'System.Int64',
'System.Single',
'System.UInt16',
'System.UInt32',
'System.UInt64')
if ( $types -contains $type ) {
Write-Output "$type"
}
else {
Write-Output 'System.String'
}
} #Get-Type
function Out-DataTable
{
[CmdletBinding()]
param([Parameter(Position=0, Mandatory=$true, ValueFromPipeline = $true)] [PSObject[]]$InputObject)
Begin
{
$dt = new-object Data.datatable
$First = $true
}
Process
{
Write-Output "test"
foreach ($object in $InputObject)
{
$DR = $DT.NewRow()
foreach($property in $object.PsObject.get_properties())
{
if ($first)
{
$Col = new-object Data.DataColumn
$Col.ColumnName = $property.Name.ToString()
if ($property.value)
{
if ($property.value -isnot [System.DBNull]) {
$Col.DataType = [System.Type]::GetType("$(Get-Type $property.TypeNameOfValue)")
}
}
$DT.Columns.Add($Col)
}
if ($property.Gettype().IsArray) {
$DR.Item($property.Name) =$property.value | ConvertTo-XML -AS String -NoTypeInformation -Depth 1
}
else {
$DR.Item($property.Name) = $property.value
}
}
$DT.Rows.Add($DR)
$First = $false
}
}
End
{
Write-Output #(,($dt))
}
} #Out-DataTable
$allEvents = Get-WinEvent -LogName ForwardedEvents | Where-Object{$_.Id -ne 111}
$outEvents = #()
$dt = $null
foreach ($curEvent in $allEvents){
$curObj = $null
switch ($curEvent.ID) {
4624 {
$curObj = New-Object -TypeName PSObject
Add-Member -InputObject $curObj -MemberType NoteProperty -Name TimeCreated -Value ([datetime]$curEvent.TimeCreated)
Add-Member -InputObject $curObj -MemberType NoteProperty -Name Action -Value $curEvent.TaskDisplayName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name MachineName -Value $curEvent.MachineName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name UserName -Value ((($curEvent.Message).Split([Environment]::NewLine)[36]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name LoginID -Value ((($curEvent.Message).Split([Environment]::NewLine)[40]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name SourceIP -Value ((($curEvent.Message).Split([Environment]::NewLine)[64]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name ID -Value $curEvent.Id
Add-Member -InputObject $curObj -MemberType NoteProperty -Name RecordID -Value $curEvent.RecordID
}
4647 {
$curObj = New-Object -TypeName PSObject
Add-Member -InputObject $curObj -MemberType NoteProperty -Name TimeCreated -Value ([datetime]$curEvent.TimeCreated)
Add-Member -InputObject $curObj -MemberType NoteProperty -Name Action -Value $curEvent.TaskDisplayName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name MachineName -Value $curEvent.MachineName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name UserName -Value ((($curEvent.Message).Split([Environment]::NewLine)[8]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name LoginID -Value ((($curEvent.Message).Split([Environment]::NewLine)[12]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name SourceIP -Value "Not Available"
Add-Member -InputObject $curObj -MemberType NoteProperty -Name ID -Value $curEvent.Id
Add-Member -InputObject $curObj -MemberType NoteProperty -Name RecordID -Value $curEvent.RecordID
}
4778 {
$curObj = New-Object -TypeName PSObject
Add-Member -InputObject $curObj -MemberType NoteProperty -Name TimeCreated -Value ([datetime]$curEvent.TimeCreated)
Add-Member -InputObject $curObj -MemberType NoteProperty -Name Action -Value "Reconnect"
Add-Member -InputObject $curObj -MemberType NoteProperty -Name MachineName -Value $curEvent.MachineName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name UserName -Value ((($curEvent.Message).Split([Environment]::NewLine)[6]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name LoginID -Value ((($curEvent.Message).Split([Environment]::NewLine)[10]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name SourceIP -Value ((($curEvent.Message).Split([Environment]::NewLine)[24]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name ID -Value $curEvent.Id
Add-Member -InputObject $curObj -MemberType NoteProperty -Name RecordID -Value $curEvent.RecordID
}
4800 {
$curObj = New-Object -TypeName PSObject
Add-Member -InputObject $curObj -MemberType NoteProperty -Name TimeCreated -Value ([datetime]$curEvent.TimeCreated)
Add-Member -InputObject $curObj -MemberType NoteProperty -Name Action -Value "Locked"
Add-Member -InputObject $curObj -MemberType NoteProperty -Name MachineName -Value $curEvent.MachineName
Add-Member -InputObject $curObj -MemberType NoteProperty -Name UserName -Value ((($curEvent.Message).Split([Environment]::NewLine)[8]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name LoginID -Value ((($curEvent.Message).Split([Environment]::NewLine)[12]).split(":")[1]).Trim()
Add-Member -InputObject $curObj -MemberType NoteProperty -Name SourceIP -Value "Not Available"
Add-Member -InputObject $curObj -MemberType NoteProperty -Name ID -Value $curEvent.Id
Add-Member -InputObject $curObj -MemberType NoteProperty -Name RecordID -Value $curEvent.RecordID
}
Default { }
}
$outEvents += $curObj
}
$outEvents
$dt = Out-DataTable -InputObject $outEvents
When I run this, the last output of $outEvents lists all of the event objects with the correct details however trying to pipt it into Out-DataTable returns:
Out-DataTable : Cannot bind argument to parameter 'InputObject' because it is null.
At \\server\scripts\Repository\Write-UserLoginEvent\Write-UserLoginEvent.ps1:140 char:38
+ $dt = Out-DataTable -InputObject $outEvents
+ ~~~~~~~
+ CategoryInfo : InvalidData: (:) [Out-DataTable], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Out-DataTable
I've tried all different methods of formatting the data etc and I can't seem to get this function to accept my custom object array.
If I use a built in function like 'Get-Process' the function works correctly and returns the DataTable so I'm thinking it is something specific to the object I'm returning.
EDIT: Before I posted this, I also moved the DataTable segment into the loop, to attempt to print each event object as an individual DataTable. Hoping to identify where the issue was. It failed immediately on the first object.

Answer 1

So the issue was that I had an un-captured event type that had slipped through.
Because this event was not being formatted correctly there was a single event in the output that would not fit into the DataTable structure, causing the NULL error.
To identify the issue I put an Out-DataTable step inside the loop to process each object individually and in the output I could see that all objects succeeded except one. Tracking down that one I could see that I hadn't catered for that Event ID (8001).