StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POHow can I group-objects in powershell that are *almost* the same?
text
Body
copied!<p>I am trying to get a count of events in the event log, using the following:</p> <pre><code>get-eventlog application -Entrytype Error -After (Get-Date).AddDays(-7) | group-object -property eventID, source, message </code></pre> <p>However, because there is a timestamp in the message of some of the event messages, they don't group properly. (OK technically they "do" group properly, but I want a count of all of them.)</p> <p>Too give an example, there is this error:</p> <pre><code>3221241857 Failed to schedule Software Protection service for re-start at 2113-09-21T21:37:24Z. Error Code: 0x80041316. </code></pre> <p>I want to group all of these so that I get a count of all of these on one line, rather than a line for each error as it is treating the message as unique because the timestamp differs.</p> <p>Can I remove the timestamp with a regular expression or something? Not sure how to do that in PS.</p> <p>Just to illustrate this, I currently get: </p> <pre><code> Name : 489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Count : 12 Group : {System.Diagnostics.EventLogEntry} Values : {489, ESENT, taskhostex (1560) An attempt to open the file "C:\Users\xxxx\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).} Name : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316. Count : 1 Group : {System.Diagnostics.EventLogEntry} Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T15:41:11Z. Error Code: 0x80041316.} Name : 16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316. Count : 1 Group : {System.Diagnostics.EventLogEntry} Values : {16385, Software Protection Platform Service, Failed to schedule Software Protection service for re-start at 2113-09-21T20:03:35Z. Error Code: 0x80041316.} </code></pre> <p>But the bottom errors should be grouped together.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload