PowerShell Get-WinEvent Data Query - powershell

Question

Trying to write a script to retrieve all the details for events being triggered for a certain issue.
The events that have been seen within the event viewer have no Event ID's etc. that would help to filter the results.
The only data I can potential use is contained within the EventData section with "Married"
Get-WinEvent #{LogName='Application';Level=2} | Where {$_.ProviderName -eq 'BizTalk Server' -and $_.Message -contains 'Marri'}
I'm not sure if the $_.Message is looking at the EventData section.. any advice?

Answer 1

So this isn't a fully working solution but it should give you an output of data that provides you with insight on what to use.
I can't really do it for you completely because i don't have the data to test with.
$events = Get-WinEvent -FilterHashTable #{LogName = "Application";Level=2} -MaxEvents 50 | where {$_.Message -like '*'}
foreach($event in $events){
"-"*150
$eventXML = [xml]$event.ToXml()
#if there is data in the XML
if($eventXML.Event.EventData.data -like '*Marri*'){
$event.Message
$event | gm
write-host $event
write-host $eventXML.Event.EventData.data -ForegroundColor Green
}
"-"*150
}

Answer 2

I don't really understand what you mean with the count /date time part.
you could display the time and provider so:
$events = Get-WinEvent -FilterHashTable #{LogName = "Application";Level=2} -MaxEvents 50 |
where {$_.Message -like '*'}
foreach($event in $events){
"-"*50
$event.TimeCreated
$event.ProviderName
$event.Message
"-"*50
}

Answer 3

I don't know where in eventdata "married" is, but in powershell 6 you can do something like this and use -filterhashtable on eventdata named data fields. Providername can be in the hashtable as well.
Get-WinEvent #{LogName='Application'; Level=2;
providername='biztalk server'; status='married'}
An example that works for me:
get-winevent #{ logname = 'application'; param2 = 'suppressduplicateduration' }