选择字符串以从日志文件条目中获取时间格式

Question

I am trying to pull date and time from the similar string below:

<![LOG[Inventory: Successfully sent report. Destination:mp:MP_SinvEndpoint, ID: {CFF6CD46-AEC7-4BFB-8B09-E7507346AAF6}, Timeout: 80640 minutes MsgMode: Signed, Not Encrypted]LOG]!><time="14:30:50.088+300" date="09-24-2013" component="InventoryAgent" context="" type="1" thread="4448" file="agentstate.cpp:2038">

I am using these declarations:

$Sinv = Select-String $env:windir\syswow64\ccm\logs\inventoryagent.log -pattern "SinvEndpoint" -SimpleMatch | select-object -last 1

$Hinv = Select-String $env:windir\syswow64\ccm\logs\inventoryagent.log -pattern "HinvEndpoint" -SimpleMatch | select-object -last 1

$DDR = Select-String $env:windir\syswow64\ccm\logs\inventoryagent.log -pattern "DdrEndpoint" -SimpleMatch | select-object -last 1

I am trying to identify in which order each of their last entries happen (based on timestamp in its string) and then I will write code accordingly.

Answer 1

You should be able to extract date and time information with something like this (assuming you have PowerShell v3 installed):

$file    = "$env:windir\syswow64\ccm\logs\inventoryagent.log"
$pattern = 'SinvEndpoint.*<time="(.*?)" date="(.*?)"'

$Sinv = Select-String $pattern $file | select -Last 1 | % {
          $_.Matches.Groups[2].Value + ' ' + $_.Matches.Groups[1].Value
        }