Question : Get-Eventlog -> Export-CSV long eventmessages -> problem

Some eventlog-messages contains many characters and maybe with linebreaks and tabs.
An log-event like this gives me some problems:
The browser service was unable to retrieve a list of servers from the browser master \\DSM10 on the network \Device\NetBT_Tcpip_{827421EA-F9AC-48F7-995E-779EC20ED43A}.
 
 Browser master: \\DSM10
 Network: \Device\NetBT_Tcpip_{827421EA-F9AC-48F7-995E-779EC20ED43A}
 
 This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


I've tried using -split to create and array of elements only containing a word and them -join them to a string:
1:

$_.Message -Split " `n") | foreach { $_ -split " "} | where {$_ -ne ""}) -join " "


which succesfully removes tabs and linebreaks, when looking from within Powershell/PowerGUI, but when opening the output CSV-file it self or when trying to import the CSV-file it stretches over several lines:

"<servername>";"8021";"BROWSER";"Warning";"05-30-2010";"05:05:21";"The browser service was unable to retrieve a list of servers from the browser master \\DSM10 on the network \Device\NetBT_Tcpip_{827421EA-F9AC-48F7-995E-779EC20ED43A}.



Browser master: \\DSM10

Network: \Device\NetBT_Tcpip_{827421EA-F9AC-48F7-995E-779EC20ED43A}



This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box."


I've also tried Export-CSV with -encoding UTF8, ASCII and unicode with no luck.

I've attached the Powershell-code that gets the eventlog and exports it.

Any ideas? 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:

$Servers = "<server01>", "<server02>"
$OutputDir = "<path>"

$now = Get-Date

$Message 	= @{ l= "Message";E={ (($_.Message -Split " `n") | foreach { $_ -split " "} | where {$_ -ne ""}) -join " " } } 

$HistoryFrom = (Get-Date).AddDays(-20)
$Systemlog = Get-EventLog -ComputerName $Servers -LogName system -EntryType warning, error -After $HistoryFrom
$Applicationlog = Get-EventLog -ComputerName $Servers -LogName application -EntryType warning, error -After $HistoryFrom 

$Systemlog + $Applicationlog | select MachineName, EventID, Source, EntryType, LastWriteTime, $Message | 
	Export-Csv "$OutputDir\Test.csv" -NoTypeInformation -Encoding ASCII -Delimiter ";"

Answer : Get-Eventlog -> Export-CSV long eventmessages -> problem


Sorry, try again.

We might do:

-Replace '`r|`n|`t'

That should drop everything that might make it messy...

Chris
Random Solutions  
 
programming4us programming4us