Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some servers that are commonly having error 1000s. I want to find if it's the same application all the time, or if it's different applications. I am using this:

Get-EventLog application 1000 -entrytype error -newest 10 | select timegenerated,message | Export-Csv errors.csv

and the output shows the application name (specifically the exe file) as part of the multi-line message field.

I have not been able to figure out how to extract just the application name from the output.

Piping the output to Get-Member makes it look like the message field is an array, but I cannot figure out how to extract that part of the array at this point.


Get-EventLog application 1000 -entrytype error -newest 10 | %{$_.machinename,$_.timegenerated,$_.ReplacementStrings[0]}

This gives me the output I want, except it's generated over three lines, and Export-CSV doesn't want to parse it properly. How can I get them all on one line?

share|improve this question
    
Check my latest update –  Mark Henderson Jan 14 at 0:12
add comment

1 Answer

up vote 2 down vote accepted

It's probably not going to be accurate for all event types, but the property ReplacementStrings is an array where the first element is the name of the executable when looking at InstanceID 1000:

> Get-EventLog application 1000 -entrytype error -newest 10 | %{$_.ReplacementStrings[0]}
Ssms.exe
Ssms.exe
Ssms.exe
uniStudio.exe
SwyxIt!.exe
Ssms.exe
uniRTE.exe
uniStudio.exe
Ssms.exe
Ssms.exe

My PS-foo is weak at this time of the morning, but I'm sure there's a way to combine that with your select command and thus export them into your CSV.


As per your update; this will get you the output you need in a table format. I don't know how well it will play with export-csv though:

Get-EventLog application 1000 -entrytype error -newest 10|Format-Table @{Expression={$_.machinename};Label="Machine Name";width=25},@{Expression={$_.timegenerated.DateTime};Label="DateTime";width=25},@{Expression={$_.ReplacementStrings[0]};Label="EXEName";width=25}

Never mind; I went way too complicated in my last update. This should work just fine (I knew I'd be better later in the day):

> Get-EventLog application 1000 -entrytype error -newest 10|Select-Object  timegenerated,message,@{name='Executable';expression={$_.ReplacementStrings[0]}}|Export-CSV errors.csv


TimeGenerated                           Message                                 Executable
-------------                           -------                                 ----------
14/01/2014 7:23:13 AM                   Faulting application name: Ssms.exe,... Ssms.exe
13/01/2014 7:26:44 AM                   Faulting application name: Ssms.exe,... Ssms.exe
10/01/2014 7:30:24 AM                   Faulting application name: Ssms.exe,... Ssms.exe
8/01/2014 5:25:13 PM                    The description for Event ID '1000' ... uniStudio.exe
31/12/2013 3:09:58 PM                   The description for Event ID '1000' ... SwyxIt!.exe
19/12/2013 7:35:21 AM                   Faulting application name: Ssms.exe,... Ssms.exe
18/12/2013 2:55:45 PM                   Faulting application name: uniRTE.ex... uniRTE.exe
18/12/2013 9:25:49 AM                   The description for Event ID '1000' ... uniStudio.exe
18/12/2013 7:32:29 AM                   Faulting application name: Ssms.exe,... Ssms.exe
16/12/2013 1:22:38 PM                   Faulting application name: Ssms.exe,... Ssms.exe
share|improve this answer
1  
if you replace {...} with @{name='Executable';expression={$_.ReplacementStrings[0]}}, you get a friendlier property name. –  charleswj81 Jan 14 at 3:05
    
@charleswj81 - you certainly do; I have updated my code snippet –  Mark Henderson Jan 14 at 3:21
    
This is perfect. Thank you! –  Joshua Nurczyk Jan 14 at 13:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.