Powershell Get-Winevent Filterhashtable -


this working query have now.

powershell "get-winevent -ea silentlycontinue -filterhashtable @{providername='microsoft-windows-driverframeworks-usermode';id=2003,2100;starttime='2014-08-18 16:01:57';endtime='2014-08-18 23:59:59'} | {$_.message -match '27, 23'}| convertto-csv -notypeinformation | %{ $_ -replace """`r`n""",',' }  | select -skip 1| out-file -append c:\temp\timeline\temp.csv" 

how can change in such way fetches:

(event id 2003)       or (event id 2100 , message -match '27, 23') 

thank you..

simply change statement use -or statement, , group id , message -and statement:

where {$_.id -eq "2003" -or ($_.id -eq "2100" -and $_.message -match '27, 23')} 

Comments

Popular posts from this blog

java - How to specify maven bin in eclipse maven plugin? -

single sign on - Logging into Plone site with credentials passed through HTTP -

php - Why does AJAX not process login form? -