Powershell的:功能参数
-
12-12-2019 - |
题
我正在构建一个powershell功能,以便我可以查询多台计算机事件日志。我复制了下面的代码,我需要帮助。如果我不发送eventID,我希望脚本找到所有事件ID,我该如何实现这一点?
#this would be the parameter part of the script
[String]$ComputerName = $env:COMPUTERNAME#Current computer
[String[]]$EventLogNames=@("Application","System")#Main eventlogs
[int[]]$EventIds = 1 #Event Ids
[System.DateTime[]]$EventStartDate = (((Get-Date).addDays(-2)).date)#date 10 days ago
[System.DateTime[]]$EventEndTime = (Get-Date)#date 10 days ago
#This fits in the process section
$EventCritea = @{logname = $EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime; ID=$EventIds}
Get-WinEvent -ComputerName $ComputerName -FilterHashTable $EventCritea -ErrorAction SilentlyContinue
解决方案
首先,你的另一个 问题 修复的类型 $EventStartDate
和 $EventEndTime
.
对于这个问题:增量构建哈希表:
$filter = @{logname = $EventLogNames; StartTime=$EventStartDate; EndTime=$EventEndTime}
if ($EventIds -ne $null -and $EventIds.Length -gt 0) {
$filter.ID=$EventIds
}
Get-WinEvent -ComputerName $ComputerName -FilterHashTable $filter #...
不隶属于 StackOverflow