I have a script that goes out and gets events and returns them based on a time and span. The output is optionally saved to a csv, if the switch it set. Here’s a snippet:
$Time = ((Get-Date).AddMinutes(-10))
if ($CSVOut -eq $true) {
$CSVName = "$env:USERPROFILE\Desktop\Get-EventsAround $Time Result.csv" -replace '/','-' -replace ':','.'
$Result | Export-Csv -Path $CSVName -NoTypeInformation -Force
notepad $CSVName
}
I run this part and it works fine.
PS C:\Users\administrator> $Time = ((Get-Date).AddMinutes(-10))
PS C:\Users\administrator> $CSVName = "$env:USERPROFILE\Desktop\Get-EventsAround $Time Result.csv" -replace '/','-' -replace ':','.'
PS C:\Users\administrator> $CSVName
C.\Users\administrator\Desktop\Get-EventsAround 01-07-2016 10.46.57 Result.csv
But if I run the script, it adds this extra text to my $CSVName string variable. like this:
PS C:\Users\administrator> Get-EventsAround -Servers 'xxexch07','.' -Range 5 -Time "January 06, 2016 10:21:37PM" -CSVOut
Export-Csv : Could not find a part of the path 'C:\Users\administrator\C\Users\administrator\Desktop\Get-EventsAround 01-06-2016 22.21.37 Result.csv'.
At line:67 char:33
+ $Result | Export-Csv <<<< -Path $CSVName -NoTypeInformation -Force
+ CategoryInfo : OpenError: (:) [Export-Csv], DirectoryNotFoundException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.ExportCsvCommand
No clues in this guy’s brain. What am I doing wrong?
Just posting the full script in a separate comment. I use it all the time, it works great except for this new feature.
Function Get-EventsAround
{
[CmdletBinding()]
Param
(
# Enter the time range in minutes to look for events before/after the given TimeStamp, default is 10
[Parameter(Position=0)]
[int]
$Range = 10,
# Enter the TimeStamp in quotes like this: '6/30/2015 6:00:00pm'
[Parameter(Position=1)]
[datetime]
$Time = ((Get-Date).AddMinutes(-10)),
# Enter the server(s) as strings separated by commas, default is localhost
[Parameter()]
[string[]]
$Servers = '.',
# The results will be listed in full instead of a table with less info
[Parameter()]
[switch]
$List = $false,
# The results will be listed on screen AND output into a CSV file.
[Parameter()]
[switch]
$CSVOut = $false
)
Begin
{
$StartTime = $Time.AddMinutes(-$Range)
$EndTime = $Time.AddMinutes($Range)
}
Process
{
$SysLogResult = Get-EventLog -LogName System -ComputerName $Servers -Before $EndTime -After $StartTime |
Select @{Name="Log";Expression={'SYS'}},
@{Name="Server";Expression={$_.MachineName -replace '\..*$',''}},
EntryType, TimeWritten, Source, Message
$AppLogResult = Get-EventLog -LogName Application -ComputerName $Servers -Before $EndTime -After $StartTime |
Select @{Name="Log";Expression={'APP'}},
@{Name="Server";Expression={$_.MachineName -replace '\..*$',''}},
EntryType, TimeWritten, Source, Message
$Result = $SysLogResult + $AppLogResult |
select Log, Server, EntryType, TimeWritten, Source, Message |
sort TimeWritten
}
End
{
Write-Host "Showing Events from $StartTime to $EndTime"
if ($List -eq $true) {
$Result | fl
} else {
$Result | ft -AutoSize
}
if ($CSVOut -eq $true) {
$CSVName = "$env:USERPROFILE\Desktop\Get-EventsAround $Time Result.csv" -replace '/','-' -replace ':','.'
$Result | Export-Csv -Path $CSVName -NoTypeInformation -Force
notepad $CSVName
}
}
}
With the last replace …
-replace ':','.'
… you replace all colons in your path, including the one used to specify what drive you want to store it at (does so in your example as well).
So instead of:
C:\Users...
You end up with:
C.\Users...
THANK YOU!
changed line 75 to this and it works now!
$CSVName = ("$env:USERPROFILE\Desktop\Get-EventsAround " + ("$Time Result.csv" -replace '/','-' -replace ':','.'))