Powershell Get-Winevent Filterhashtable -
this working query have now.
powershell "get-winevent -ea silentlycontinue -filterhashtable @{providername='microsoft-windows-driverframeworks-usermode';id=2003,2100;starttime='2014-08-18 16:01:57';endtime='2014-08-18 23:59:59'} | {$_.message -match '27, 23'}| convertto-csv -notypeinformation | %{ $_ -replace """`r`n""",',' } | select -skip 1| out-file -append c:\temp\timeline\temp.csv" how can change in such way fetches:
(event id 2003) or (event id 2100 , message -match '27, 23') thank you..
simply change statement use -or statement, , group id , message -and statement:
where {$_.id -eq "2003" -or ($_.id -eq "2100" -and $_.message -match '27, 23')}
Comments
Post a Comment