My question Is there a way to select Virtualname with select-string? I have these logs from where I need to select the time and virtual account name. I

*>   <event seq="453211" time="2019-01-24 11:01:03.639873 -0500" app="hServer 7.45" name="I_SFS_TRANSFER_FILE" desc="Virtual filesystem: transfer file.">
      <session id="44500" service="SSH" remoteAddress="00.00.00:57292" virtualAccount="xxxxxxxx" windowsAccount="Server3\Users"/>
      <channel type="session" id="1"/>
      <sfs moduleName="FlowSfsWin" mountPath="/" code="90000" desc="Transferring file ended.">*

This is what I tried so far.

New-Item "C:\clients.log" -type file -force
$strings = "virtualAccount=","time="
Foreach($string in $strings){
Get-Content 'C:\uploads.log'| 
Select-String $string1 -AllMatches | % { $_.Matches } | % { $_.Value }  |
Add-Content "C:\clients.log"
  • Are there one or more virtualAccount and time fields per logfile? If there are more per file: Is the info as shown on one line or including the line breaks like your example? – Gert Jan Kraaijeveld Jan 25 at 13:30
  • There are more, its just one line I copied – Jon drew Jan 25 at 13:54
  • You should show what results you do expect. – LotPings Jan 25 at 18:57

If your code gave the data wanted, my guess is that it was not in the order you want it. I assume want to have the timestamps and account names together and not a separate bunch of timestamps, followed by the account names. I wrote the example below that creates a $myInfo object containing the info you want from the log lines. I hope it helps to write your solution.

I have to say the regex's are not mine. I had a hard time capturing the text between the quotes. Google helped: https://stackoverflow.com/questions/13024073/regex-c-sharp-extract-text-within-double-quotes

foreach ($line in Get-Content 'C:\uploads.log') {
    $rslt = $line | Select-String -Pattern 'time=\"([^\"]*)\".*virtualAccount=\"([^\"]*)\"'
    $myinfo = [PSCustomObject]@{
        Time = $rslt.Matches.Groups[1].Value;
        Account = $rslt.Matches.Groups[2].Value
  • No luck error Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [], RuntimeException + FullyQualifiedErrorId : NullArray Cannot index into a null array. At line:3 char:5 + [PSCustomObject]@{ + ~~~~~~~~~~~~~~~~~~ – Jon drew Jan 28 at 8:43
  • Probably not every line in the log contains the strings searched. If that is the case you should add a check on that or add a try-catch – Gert Jan Kraaijeveld Jan 28 at 9:46
  • Yeah got, I will need to copy all in one line, thats gona be tough work – Jon drew Jan 28 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.