Powershell 5.1: show simple progress in a pipe

Question

Powershell 5.1: show simple progress in a pipe

Joachim 26

I use this command to find EventID 4625 (bad logons) on my domain controlers:

Get-EventLog -ComputerName $server -LogName 'security' -InstanceId 4625 | select @{Label='Time';Expression={$.TimeGenerated.ToString('g')}}, @{Label='User Name';Expression={$.replacementstrings[5]}}, @{Label='Client Name';Expression={$.replacementstrings[13]}}, @{Label='Client Address';Expression={$.replacementstrings[19]}} | Export-Csv $path\4625_$server.csv -NoTypeInformation -Delimiter ";"

Since this can run for a very long time I would like to have a very simple progress report. Like writing an "." for every event entry it finds. But everything I came up with messes up the export to csv. Any ideas?

6 answers

Your answer

Answer 1

Before adding any progress indicator I think you'd do yourself a huge favor by switching to the Get-WinEvent cmdlet and let the target system do the search instead of having Get-EventLog return a huge number of events to be filtered locally.

Get-WinEvent -FilterHashtable @{LogName="Security";ID=4625} -ComputerName $server

Here's one link that uses the same criteria as your example: better-event-logs-with-powershell

If all you want as a progress indicator then pipe the results into a ForEach-Object and use "Write-Host '.' -NoNewline" followed by whatever data extraction you'd like.

Answer 2

Hello @Joachim

I can recommend:

1- Progress bar: using https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/write-progress?view=powershell-7.2
https://devblogs.microsoft.com/scripting/add-a-progress-bar-to-your-powershell-script/

2- Show verbose results for each finding: https://devblogs.microsoft.com/scripting/use-powershell-to-write-verbose-output/

Hope this helps with your query,

----------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Joachim 26

Thank you for your suggestions. I know both methods, but imho they dont work as part of a pipe (where in the end i export to a csv)

Rich Matheisen 47,901 Reputation points

2021-12-03T20:57:34.477+00:00
Your opinion is misinformed!

This produces 10 "dots" on the console and a CSV with one column named "Count" and ten rows holding the numbers 1 through 10.

1..10 | ForEach-Object {Write-Host "." -NoNewline; [pscustomobject]@{Count=$_ }} | export-csv c:\junk\count.csv -NoTypeInformation

Answer 4

Joachim 26

I try to clarify it: what I would need is to execute a pipe and WHILE the pipe is running, regardless what it is doing, to output something on the screen every second, so the user knows: this script is still doing something.

Example
Searching for Event I 1234
................................ (<< THIS is what I want to see while the pipe is running)
Done

Rich Matheisen 47,901 Reputation points

2021-12-03T21:04:47.137+00:00

If you're expecting to see your 'progress' indicator while Get-EventLog searching for something that's not gonna happen (at least not easily). But once Get-EventLog starts returning the items it finds then you can start showing the progress indicator output.

This "waiting" is why I suggested using the new Get-WinEvent. That makes the search happen on the target machine and it is much faster.
Rich Matheisen 47,901 Reputation points

2021-12-03T22:55:14.473+00:00

I suppose you could place the Get-WinEvent in a script block and run it using Start-Job. Then run Get-Job in a loop with a small Start-Sleep interval until the job is finished.
Joachim 26 Reputation points

2022-07-27T07:43:17.3+00:00

That's the solution to my question, thank you :)

Answer 5

Jose Antonio Silva 11

@Rich Matheisen is right. Progress bars depend on a reference percentage. If you are doing a search like this, you can't have a real progress because you can calculate how many records you will find.

If what you want is a signal of what already was found, just pipe the results into a simple dot as already proposed. Just keep piping out the current $_ to make sure you can get the results to the next command

Get-WinEvent -FilterHashtable @{LogName="Security";ID=4625} -ComputerName $server |  
    %{  Write-Host "." -NoNewline; $_ } | export-csv c:\junk\count.csv -NoTypeInformation

Joachim 26 Reputation points

2022-07-27T07:45:25.977+00:00

I was not looking for a progress bar, I asked for a "this script is still alive" message.

@Rich Matheisen provided the solution: "Place the Get-WinEvent in a script block and run it using Start-Job. Then run Get-Job in a loop with a small Start-Sleep interval until the job is finished."

Sadly I cant mark this as an answer.

Share via

Powershell 5.1: show simple progress in a pipe

6 answers

Your answer