从文本文件导入并导出到 CSV powershell

Question

我目前的任务是找出用户在我们的系统中登录了哪些桌面。我对 Powershell 还很陌生，所以对于很长的帖子和凌乱的脚本，我深表歉意

有一个登录脚本可以在用户登录时将此信息放入日志文件中。如下图。

Script started: 1/01/2010 00:00:00

Information : Script Ver:       1.05
Information : LOGONSERVER:      %servername%
Information : USERNAME:         %username%
Information : COMPUTERNAME:     %computername%
Information : COMPUTER SITE:    $location%
Information : OS Version:       %system%
Information : Domain:           %domain%

我需要同时获取“Script started: 1/01/2010 00:00:00”和“Information : COMPUTERNAME: %computername%”，然后将这些部分导出到 CSV 文件中。我可以使用

获取信息

$Str ComputerName = Get-Content -Path %log%| Select-String "COMPUTERNAME:"

对于多个用户，这只会让我最后一台计算机登录到日志文件中的并非所有桌面。有没有办法获取所有计算机名称和脚本启动并将它们导出到单独列中的 CSV 文件中？也许是一种更简单、更短的方法。

Foreach ($ObjCSVline in $(Import-csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogon.csv"))
{
$strUsername = $ObjCSVline.Lastlogon

try {
$arrUserIdOutput = Get-ADUser $strUsername -Properties homedirectory | select *
} catch {
Write-Host "User: " $strUsername" Does not exist"
}

$strUserHomeDirectory = $arrUserIdOutput.HomeDirectory
$strUserLogs = $strUserHomeDirectory + $strLogFile

if ((Test-Path $strUserLogs) -eq $true) {

    $strLogs = Get-Content $strUserLogs | Select-String "Script started:        " | Select-Object -Last 1

    $Time = $strLogs -replace "Script started:      ","" 

    $StrComp = Get-Content $strUserLogs | Select-String "Information : COMPUTERNAME:    " | Select-Object -Last 1

    $computerID = $StrComp -replace "Information : COMPUTERNAME:    ",""

} else { $strUserLogs = $strUserLogs + $strOldLogFile
    if ((Test-Path $strUserLogs) -eq $true) {

    $strLogs = Get-Content $strUserLogs | Select-String "Script started: " | Select-Object -Last 1

    $Time = $strLogs -replace "Script started: ",""
    } else 
    {
    Write-Host "unable to find log file for" $strUsername
    }
    }

$objOutput.desktop = $computerID
$objOutput.TimeOutput = $Time
$objOutput.Username = $strUsername
$objOutput | Select-Object Username,TimeOutput,desktop | Export-Csv "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation
}

Answer 1

因此，鉴于该日志文件的格式，我建议对“Script Started”或“Information：COMPUTERNAME：”或“Information：USERNAME：”使用 RegEx 匹配。然后对于每场比赛，我会通过 Switch 运行该比赛，以将结果分配给 $LoginDate、$UserName 或 $ComputerName 的适当变量。切换完成后，我检查我们是否记录了所有 3 个项目，如果是，则输出一个包含三个属性的自定义对象，并清除变量以设置下一个登录记录。这将做到这一点：

GC $strUserLogs|?{$_ -match "(Script started:\s*?|Information.+?: COMPUTERNAME:.\s*?|Information.+?: USERNAME:.\s*?)(\w.*)"}|%{
    Switch($Matches[1]){
        {$Matches[1] -like "Script Started*"}{$LoginDate = $Matches[2]}
        {$Matches[1] -like "*USERNAME*"}{$UserName = $Matches[2]}
        {$Matches[1] -like "*COMPUTERNAME*"}{$ComputerName = $Matches[2]}
    }
    If($LoginDate -and $UserName -and $ComputerName){
        [PSCustomObject]@{
            "Login Date"=$LoginDate
            "Computer Name"=$ComputerName
            "User Name"=$UserName
        }
    Remove-Variable LoginDate,ComputerName,UserName
    }
}|Sort "User Name","Login Date"|Export-CSV "\\tgfilp05\hdact\DFP\Nat\Scripts\LastLogon\LastLogonDetails.csv" -Append -NoTypeInformation

最后，我按用户和日期排序，然后导出到示例中的日志文件。在没有导出到 CSV 并让它输出到屏幕的情况下，我解析了一个测试日志文件：

Script started: 1/01/2010 00:00:00

Information : Script Ver:       1.05
Information : LOGONSERVER:      %servername%
Information : USERNAME:         JimBob
Information : COMPUTERNAME:     DesktopA
Information : COMPUTER SITE:    $location%
Information : OS Version:       %system%
Information : Domain:           %domain%
Script started: 1/02/2010 00:00:00

Information : Script Ver:       1.05
Information : LOGONSERVER:      %servername%
Information : USERNAME:         MarySue
Information : COMPUTERNAME:     LaptopB
Information : COMPUTER SITE:    $location%
Information : OS Version:       %system%
Information : Domain:           %domain%
Script started: 1/03/2010 00:00:00

Information : Script Ver:       1.05
Information : LOGONSERVER:      %servername%
Information : USERNAME:         JimBob
Information : COMPUTERNAME:     ServerC
Information : COMPUTER SITE:    $location%
Information : OS Version:       %system%
Information : Domain:           %domain%

而且输出很好：

Login Date                        Computer Name                     User Name                       
----------                        -------------                     ---------                       
1/01/2010 00:00:00                ServerC                           JimBob                          
1/03/2010 00:00:00                LaptopB                           JimBob                          
1/02/2010 00:00:00                DesktopA                          MarySue