# Extract information from Log file using powershell

**URL:** <https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247>\
**Category:** PowerShell Help\
**Created:** [September 23, 2016, 4:02am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247 "2016-09-23T04:02:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![amar-helloween](https://avatars.discourse-cdn.com/v4/letter/a/73ab20/32.png) [@amar-helloween](https://forums.powershell.org/u/amar-helloween)\
**Post date:** [September 23, 2016, 4:02am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/1 "2016-09-23T04:02:27Z")

</div>

Hi all,

i have to extract the total number of times a mail id occurred with the count . I want the top 5 list. example

Domain count

* * *

[a@b.com](mailto:a@b.com) 10  
[a@bb.com](mailto:a@bb.com) 3  
[a.4@c.com](mailto:a.4@c.com) 2

here is the log file :

> <https://gist.github.com/anonymous/29d0844e49a13e1525414b54b581ed98>

---

<div class="post-metadata">

**Author:** ![daniel-krebs](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/daniel-krebs/32/484_2.png) [@daniel-krebs](https://forums.powershell.org/u/daniel-krebs)\
**Post date:** [September 23, 2016, 6:21am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/2 "2016-09-23T06:21:46Z")

</div>

Very important in the future please do not post the content of internal log files without changing details like email addresses to something anonymous. You’ve just exposed hundreds of email addresses of your company to spam bots crawling the web.

A combination of RegEx and the Group-Object cmdlet usually works great for me if I need to extract and count the value of properties. I’ve created a sample script for you which works on the log file you’ve provided.

> <https://gist.github.com/Dan1el42/fbdef8a0be6a599c7b4c203d22283af2>

---

<div class="post-metadata">

**Author:** ![rob-simmers](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/rob-simmers/32/1010_2.png) [@rob-simmers](https://forums.powershell.org/u/rob-simmers)\
**Post date:** [September 23, 2016, 6:24am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/3 "2016-09-23T06:24:09Z")

</div>

Have you tried anything? If you simply want occurrences of the email address, you should look at a REGEX pattern for email addresses. If you want the date as well, you can find regex pattern for the date format and use grouping and match both with a single REGEX pattern.

---

<div class="post-metadata">

**Author:** ![random-commandline](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@random-commandline](https://forums.powershell.org/u/random-commandline)\
**Post date:** [September 23, 2016, 9:46am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/4 "2016-09-23T09:46:43Z")

</div>

```
# list top 5 results
$file = Get-ChildItem '\\path\to\logfile.log'
$users = switch -regex -file $file {
'User (.*) logged on' {$Matches[1]} 
}

$users | Group-Object | Sort-Object -Descending -Property count|
Select-Object Name,Count -First 5
}
```

---

<div class="post-metadata">

**Author:** ![daniel-krebs](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/daniel-krebs/32/484_2.png) [@daniel-krebs](https://forums.powershell.org/u/daniel-krebs)\
**Post date:** [September 23, 2016, 10:07am UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/5 "2016-09-23T10:07:41Z")

</div>

@random Cool. I was not aware of the -file parameter for the switch statement. Thanks very much for the example.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:40pm UTC](https://forums.powershell.org/t/extract-information-from-log-file-using-powershell/7247/6 "2024-05-16T20:40:18Z")

</div>