Powershell extracting logs based upon interval? - powershell

Question

I have script logic as follows:-
check if the folder is empty
If yes Use the same command with exception time period of last 30 days. i.e StartDate etc
If folder not empty get / extract the logs for 1 day using same command
just tweaking timesettings.
the script will be scheduled to run every 5 minutes. For every run extract using the same command for 1 day saves the result in temp.csv and compare it most updated copy of final-admin.csv.
If changes found; write difference / over-write in
final-admin.csv
code
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
$outcsv='c:\Mail-audit-results\Final-mail-admin.csv'
if(Get-ChildItem C:\Mail-audit-results){
$enddate=[datetime]::Today
$Startdate=$enddate.AddDays(-1)
$splat=#{
Identity='mail.test-nw.com'
LogonTypes=#('Admin','Delegate')
ShowDetails=$true
StartDate=$Startdate
EndDate=$enddate
}
Search-MailboxAuditLog #splat | Export-Csv c:\Mail-audit-results\temp_results.csv -NoTypeInformation -Append
$Old = Import-CSV $outcsv
$New = Import-CSV c:\Mail-audit-results\temp_results.csv
$New | ?{$Old -notmatch $_} | Export-CSV $outcsv -notype
}
#process items when files found
}else{
# process when no files found.
$enddate=[datetime]::Today
$Startdate=$enddate.AddDays(-30)
$splat=#{
Identity='mail.test-nw.com'
LogonTypes=#('Admin','Delegate')
ShowDetails=$true
StartDate=$Startdate
EndDate=$enddate
}
Search-MailboxAuditLog #splat | Export-Csv $outcsv -NoTypeInformation -Append
}
Get-ChildItem 'c:\Mail-audit-results\Final-mail-admin.csv' | ForEach {
Else
{
return 0;
}
}
Problem-points
How can I change the format of date in mm/dd/yyy format in section
$enddate=[datetime]::Today
$Startdate=$enddate.AddDays(-1)
How to overwrite with difference data?
$New | ?{$Old -notmatch $_} | Export-CSV $outcsv -notype
I don't want to write to third file the difference I want original file $outcsv to get written; would the above command overwrite/ or just append?
Thanks.

Answer 1

You can change your dates using -Uformat switch
$enddate= Get-Date ([datetime]::Today) -UFormat "%m%d%Y"
$Startdate= Get-Date ($enddate.AddDays(-1)) -UFormat "%m%d%Y"
The line
$New | ?{$Old -notmatch $_} | Export-CSV $outcsv -notype
will overwrite data, Export-CSV -Append will append.