powershellpowerbiwindows-serverevent-viewer

Windows server 22 Powershell Get-EventLog Not Showing "Account Name:" in CSV Export


In the event viewer the field name that I am looking for in the CSV export is "Account Name:" however, this field does not display in the export but does display if the "Result in PowerShell" script is run.

Result in PowerShell:

Get-EventLog -LogName Security| Select-Object -Property * | Select -first 10

CSV Export Script:

Get-EventLog -LogName Security | Select-Object -Property * | Export-Csv -Path C:\Export.csv

What I would like to achieve is pulling a report of user activity on the file share.


Solution

  • Apply calculated properties:

    Several PowerShell cmdlets transform, group, or process input objects into output objects using parameters that allow the addition of new properties to those output objects. You can use these parameters to generate new, calculated properties on output objects based on the values of input objects. The calculated property is defined by a hashtable containing key-value pairs that specify the name of the new property, an expression to calculate the value, and optional formatting information.

    In particular, you can use calculated properties to add additional members to the objects output with the Select-Object cmdlet, e.g. as follows:

    #Requires -RunAsAdministrator
    Get-EventLog -LogName Security | 
        Select-Object -Property @{ 
                name = 'Account Name';    # or 'AccountName' with no space
                expr = {($_.Message -split [System.Environment]::NewLine |
                            Select-String 'Account Name:' -SimpleMatch |
                            Select-Object -ExpandProperty Line
                         ).Split( ':').Trim()[-1]
                       } }, * |
        Select-Object -First 2                # optional to reduce output
    

    However, some output fields (e.g. Data or ReplacementStrings) Export-Csv shows as System.Byte[], System.String[], or even System.Object[] etc. See this article :Avoiding System.Object[] (or Similar Output) when using Export-Csv