PowerShell - Find specific text in Eventlog message

Question

Using Powershell I'm pulling some event logs into a variable like this

$a = get-eventlog -logname Security -instanceid 5145 -After '11/29/2020 08:00:00'

In the message there is a line called 'Account Name' Which is the component I need to query. I've done some digging and have come up with the following, which uses a -match to find the pattern

$a.message | select-string -pattern 'Account Name:'

IT works but returns the whole message. What I need is the line 'Account Name: domsin\user1' and the information about the account name, which changes.

Does anyone know how this is done?

Answer 1

Hi，

Please see if this is what you want to pull

$a.ReplacementStrings[1]  

Best Regards，
Ian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I've managed to fix it with this PowerShell

With the Get-WinEvent command I was able to query its properties. Then as the properties we in positions 13 array members apart, I was able to build those into the $properties array.

$properties = @()

$a=1


Do{

    $a
    $properties+=$a

} While (($a = $a + 13))

$e = get-winevent -FilterHashtable @{logname='security';id=5145}

$e.properties[$properties]

Answer 3

I used event 4656 to test with.

 $events = get-eventlog -logname Security -instanceid 4656 -After '11/29/2020 08:00:00'     # 5145 
 foreach ($e in $events) {
    $tf = $e.Message   -match "(Account Name:).*[[:alpha:]]*.* *"  
    if ($tf) {  
        $matches[0] 
        $Matches[0].Split(":")[1].trim()
    }                                                        
 }