I am working on a script and have had some issues with one of my functions. As it stands, I am able to parse my log file and pull out if the user was successfully added or disabled. But, I would like to only have 1 line per user, and the date/status would be set to the last occurance
Below is the function and a snippet from my log file.
(each line starts with a date)
2015-01-13 16:11:42,157 INFO UserLib userLib: user backs (abcdefghijklm123456780opqu39erjk) successfully added
2015-01-13 16:11:42,188 INFO UserLib userLib: user robi (abcdefghijklm123456780opqu39erjk) successfully added
2015-01-13 16:11:42,235 INFO UserLib userLib: user acker (abcdefghijklm123456780opqu39erjk) successfully added
2015-01-13 16:11:43,311 INFO UserLib userLib: user amb (abcdefghijklm123456780opqu39erjk) is now disabled
2015-01-13 16:11:43,420 INFO UserLib userLib: user robi (abcdefghijklm123456780opqu39erjk) is now disabled
2015-01-14 16:11:43,420 INFO UserLib userLib: user blah (abcdefghijklm123456780opqu39erjk) successfully added
Write-Host "Reading MFeEPE log on $computername"
$results = @()
$mfeLog = get-content ".\test.log"
#$mfeDisabledUsers = $mfeLog | Select-String -SimpleMatch "is now disabled" -simplematch "Successfully added" -AllMatches
#$mfeDisabledUsers = $mfeLog | Select-String -pattern "is now disabled","Successfully added" -AllMatches
#$mfeLog | Select-String -SimpleMatch "Successfully Added" -AllMatches | ForEach{
$mfeLog | Select-String -pattern "is now disabled","Successfully added" -AllMatches | ForEach{
$t = $_.toString()
If ($t -match "disabled"){$status = "disabled"}else{$status = "enabled"}
$start = ($t.Split("'(")).Split(",") #split input on , [0] = date [1] = the rest
$userDate = $start[0].ToString()
$TheUser = ((($start[1]).Split(":"))[1]).ToString() #returns User username
$TheUser = $theuser -replace "user"
$record = New-Object System.Object
$record | Add-Member -Membertype NoteProperty -Name TheUser -Value $TheUser.Trim()
$record | Add-Member -Membertype NoteProperty -Name DateAdded -Value $UserDate
$record | Add-Member -MemberType NoteProperty -Name Status -Value $status
$results += $record
}
$results | Sort -Property DateAdded | Out-GridView
My script shows
backs 2015-01-13 16:11:42 enabled
robi 2015-01-13 16:11:42 enabled
acker 2015-01-13 16:11:42 enabled
amb 2015-01-13 16:11:43 disabled
robi 2015-01-13 16:11:43 disabled
What I would like to do is update the date and flip the enabled/disabled part if it is already there.
Any help would be greatly appreciated.
Thanks Mike