1

I am putting together some custom monitoring solutions and the logs include different date/time entries. Trying to parse the date/time (text value) from the log and convert into a date value so that I can compare with others or with system date. I have used the following in the past, but am having trouble changing to allow for single digit DD value and for 12 hour clock value.

$line = "=== 2018-01-07 03:30:25,889 [ng)'] INFO"

$dateTimeString = [regex]::Matches($line, '(\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)')[0].Groups[1].Value

$provider = New-Object System.Globalization.CultureInfo "en-US"

$dateTime = [datetime]::ParseExact($dateTimeString, 'yyyy-MM-dd HH:mm:ss', $provider)

But need to convert the following.

$line = "Error - Jan 7, 2018 2:13:19 AM EST - Warning"

I'm sure the parseexact will be: $dateTime = [datetime]::ParseExact($dateTimeString, 'MMM d, yyyy h:mm:ss tt', provider)

But I am having trouble parsing the text into these values using the Matches function.

Edit: After utilizing Bill's suggestion, when assigning variable explicitly, it works. However when I spool Get-Content to the variable it doesn't.

$line = Get-Content $SBWebPath | Select-String $SBError -casesensitive |select -last 1
Write-Output $line
$line | Select-String '^####<(\S+ \S+, \S+ \S+ \S+) \S+> <Warning>' | ForEach-Object {
$dateTime = $_.Matches[0].Groups[1].Value -as [DateTime]
}
$dateTime

Output:

####<Dec 7, 2017 5:17:26 AM EST> <Warning> <HTTP>

Edit2:

As described by Bill, the $line was being converted into an array so the ForEach-Object was not able to parse the array. By Adding | Out-String to the end of the line, it was then able to parse it as a string.

Final Code that works:

$line = Get-Content $SBWebPath | Select-String $SBError -casesensitive | Select -last 1 | Out-String
Write-Output $line
$line | Select-String '^####<(\S+ \S+, \S+ \S+ \S+) \S+> <Warning>' | ForEach-Object {
$dateTime = $_.Matches[0].Groups[1].Value -as [DateTime]
}
$dateTime

Cheers to all.

2 Answers 2

0

Here's one (fairly short) way:

$line = "Error - Jan 7, 2018 2:13:19 AM EST - Warning"
$line | Select-String '^Error - (\S+ \S+, \S+ \S+ \S+) \S+ -' | ForEach-Object {
  $dateTime = $_.Matches[0].Groups[1].Value -as [DateTime]
}
$dateTime

One caveat for this approach is you lose the time zone information.

To do this for an entire file, you can write something similar to this:

Get-Content file.txt | ForEach-Object {
  # $_ here means "current line from input file"
  $_ | Select-String '^Error - (\S+ \S+, \S+ \S+ \S+) \S+ -' | ForEach-Object {
    # $_ here means "current MatchInfo object"
    $_.Matches[0].Groups[1].Value -as [DateTime]
  }
}
2
  • I used this and it seems to be working great. However now if I don't declare $line explicitly, it is unable to convert. See Edit above. Jan 8, 2018 at 16:28
  • If you write $line = Get-Content file.txt, The $line variable will only contain one line if the file contains a single line; otherwise, it will contain an array. You can use ForEach-Object to iterate the output of Get-Content regardless of whether it contains a single line or an array. The $_ means "current item from the pipeline." See updated answer. Jan 8, 2018 at 16:40
0

I used the Get-Date command to convert strings to dates avoiding issues around cultural settings or local computer settings.

Referencing example 4 from URL https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date?view=powershell-6

(Get-Date -Year 2000 -Month 12 -Day 31).DayOfYear

I updated the file's modified date using command LastWriteTime. I parsed the filename to obtain the date and time.

$_.LastWriteTime = Get-Date -Year $y -Month $m -Day $d -Hour $h -Minute $n -Second $s

My code to update modified date for an entire directory of files is as follows. I've included all of my extra echo statements which I used during the construction of this script. Hopefully this verbosity helps you understand each step better.

Get-ChildItem 'C:\*.jpg' | ForEach-Object {

    # File Info
    echo $_.FullName
    echo $_.BaseName
    echo $_.BaseName.IndexOf(" . ")
    echo $_.BaseName.SubString(26,17)
    $y = $_.BaseName.SubString(26,4)
    $m = $_.BaseName.SubString(31,2)
    $d = $_.BaseName.SubString(34,2)
    $h = $_.BaseName.SubString(37,2)
    $n = $_.BaseName.SubString(39,2)
    $s = $_.BaseName.SubString(41,2)
    $date = "$y,$m,$d,$h,$n,$s"
    echo $date

    # Modified Date
    echo $_.LastWriteTime

    # Update Modified Date
    $_.LastWriteTime = Get-Date -Year $y -Month $m -Day $d -Hour $h -Minute $n -Second $s
    echo $_.LastWriteTime
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.