powershell group object and create csv with new header header - powershell

Question

In Windows Powershell, how can I change the csv output format of executing this command:
$logs = 'System'
$today = (Get-Date).Date
$logs | foreach{
get-eventlog -log $_ -After ([datetime]::today) |
group eventid,EntryType -noel |
sort count -desc |
export-csv "eventLog_$_.csv" -notype
}
My output must be :
"Values","Count","Group","ID","Severity"
"System.Collections.ArrayList","1085","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","1501", "Information"
"System.Collections.ArrayList","15","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","37", "Information"
"System.Collections.ArrayList","13","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","1500", "Information"
"System.Collections.ArrayList","8","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","20001", "Information"
But when running the command above, I got this output instead:
"Values","Count","Group","Name"
"System.Collections.ArrayList","1085","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","1501,Information"
"System.Collections.ArrayList","15","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","37,Information"
"System.Collections.ArrayList","13","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","1500,Information"
"System.Collections.ArrayList","8","System.Collections.ObjectModel.Collection`1[System.Management.Automation.PSObject]","20001,Information"
Is there a better way than replacing with csv file modification ?

Answer 1

I not sure why you would want a bunch of lines in your file like "System.Collections.ArrayList" and so forth. You output that you should expect from your command is
Count Name
----- ----
116 7036, Information
5 7040, Information
1 206, Information
1 14204, Information
1 7001, Information
1 201, Information
The extra information can be stripped out with a simple Select-Object. The for each loop is not required unless you acutually have something more in $logs. If the case then you should have -Append on your Export-Csv. You also dont use $today
$logs = 'System'
get-eventlog -log $logs -After ([datetime]::today) |
Group-Object EventID,EntryType -NoElement |
Sort-Object Count -Descending |
Select-Object count,name |
Export-Csv C:\temp\test.txt -NoTypeInformation
A bonus to help
The above answer might be sufficient but this adds a little to it. I mentioned that your loop seemed odd. If you are looking at other logs than System then i could see a point. I have an example below. Also the return for Name contains both and eventID and EventType and we could do something about that. I create a PSCustomObject that splits the Name into its two parts.
$logs = 'System','Application'
$logs | ForEach-Object{
get-eventlog -log $_ -After ([datetime]::today) |
Group-Object EventID,EntryType -NoElement |
Sort-Object Count -Descending |
Select-Object count,name | ForEach-Object{
[PSCustomObject]#{
'EventID' = ($_.Name -split ", ")[0]
'EventType' = ($_.Name -split ", ")[1]
'Count' = $_.Count
}
}
} | Export-Csv C:\temp\test.txt -NoTypeInformation
The CSV output looks a little better now. The following is from the truncated csv
"EventID","EventType","Count"
"7036","Information","118"
"7040","Information","5"
"102","Information","1"
"902","0","1"
"300","Information","1"
"10","Error","1"
"302","Information","1"
If you only have powershell 2.0 you wont have access to [PSCustomObject] in which cause you could do the following instead. Notice the array $csv that is built in the ForEach loop and is then piped into Export-Csv
$csv = #()
$logs = 'System','Application'
$logs | ForEach-Object{
get-eventlog -log $_ -After ([datetime]::today) |
Group-Object EventID,EntryType -NoElement |
Sort-Object Count -Descending |
Select-Object count,name | ForEach-Object{
$properties = #{
'EventID' = ($_.Name -split ", ")[0];
'EventType' = ($_.Name -split ", ")[1];
'Count' = $_.Count;
}
$psobject = new-object psobject -Property $properties
$csv += $psobject
}
}
$csv | Export-Csv C:\temp\test.txt -NoTypeInformation