How do I work with CSV in Variable? RRS feed

  • General discussion

  • I am using get-winevent to collect some data from event log.

    I was initially dumping everything to CSV file

    Then used import-csv and export-csv to manipulate the data but realised that I am probably loading and saving the same data that is already in memory which is merely wasting time writing to a file and then reading it again.

    So wondering what the best way is to work with a variable in CSV formate.


     [PsObject]$WinEvents = Get-Winevent....
    $m = Get-Content C:\ps1\XAccountName.txt
    $n = Get-Content C:\ps1\XId.txt
    $WinEvents | Import-Csv | ? { $m -notcontains $_."AccountName"} | ? { $n -notcontains $_."Id" } | Export-Csv filename.csv

    At this stage I am wondering if [Psobject] can be replaced with something that works as CSV.

    • Edited by GTEM Sunday, April 30, 2017 7:29 AM
    • Changed type Bill_Stewart Friday, July 7, 2017 4:18 PM
    • Moved by Bill_Stewart Friday, July 7, 2017 4:19 PM This is not "teach me fundamentals and basics one incremental post at a time" forum
    Saturday, April 29, 2017 4:40 PM

All replies

  • None of your code makes any sense and none of it will work in any way. 

    PsObject does nothing here.  You have not explained what you are trying to do.

    There are no CSV files in your example.

    I would suggest that you take a bit of time to learn PowerShell. 

    If you are trying to ask how to filter a result then:

    $IDs = Get-Content C:\ps1\XId.txt
    Get-WinEvent | 
    	Where-Object{$_.ID -notin $IDs} |
    	Export-Csv file.csv

    AccountName is not a property of an event.


    • Edited by jrv Saturday, April 29, 2017 6:32 PM
    Saturday, April 29, 2017 6:28 PM
  • We answered this same question in you earlier posts.  You don't have enough basic PowerShell knowledge to understand what is being posted or even what your question is.  Without a basic technical understanding of PowerShell and the Windows components your are trying to use you will not be able to understand any of this.


    Saturday, April 29, 2017 6:37 PM
  • Not sure you understand the question.

    I know the code does not work, it says just before the code e.g. (Which means it is only an example) and the "..." after get-winevent means I have stripped away some code to avoid diverting your attention to that.

    If you don't understand the question, just ask, or let somebody else that does understand the question answer it. Telling me to go and learn power-shell first was only hurtful. I am trying to lean power-shell, but getting stuck in the process and hence come to this forum to seek advice. Lets face it, if everybody knew power-shell, there would be no need to come to this forum to seek advice. (The fact that most other initial posts here are with scripts that don't work proves the point). Telling me to go and learn power-shell first is like telling a foreign student that has come to your country to learn your language to go back to their country to learn it first.

    This question is different to earlier posts although it is along the same theme but the question here is how to avoid having to write the $Winevents to CSV file, then reading the CSV file again to load it into memory to filter out the events. (Accountname is a Column in the CSV I have created in the get-winevent ... part)

    I have tried using [PSObject] and as I saw there is also other ways of setting a Variable, but none like [CSVDocument] my question was merely whether there is another data type that will hold the data in a variable in the same way it is held in a variable after import-csv so that I can work with the data in memory instead of having to write it to file first.


    Sunday, April 30, 2017 8:05 AM
  • I showed you how to get the events and process them.  Outside of that the code makes no sense as it is not PowerShell and could not work under any circumstances.  It also does not help to explain what you are trying to do.

    PsObject does nothing.  Nearly all outputs are already object.  Adding an arbitrary cast tot eh code does nothing.

    Start by going back and learning the basics of PowerShell.  Once you understand enough of teh fundamentals you will quickly see why wht you posted is not helpful and does not add up to a question.

    You need to learn what a pipeline is and why we use it.  You also need to understand what an event object is and why I noted that your code example cannot work with or without a CSV file.

    A basic pipeline might look like this:

    <get some objects> | < filter the objects> | <export the objects>

    Don't waste your time by trying to guess and by asking advanced questions without first reading the basic help for the CmdLets.

    Getting help is as easy as typing "help" for the CmdLet.  If you don't start there and learn how to read and use help you will be forever going in circles.

    What is [CSVDocument}?  There is no such thing.  What makes you think that [psobject} is of any use? It does nothing.

    Look at this

    D:\scripts> $data[0].GetType()
    IsPublic IsSerial Name                                     BaseType
    -------- -------- ----                                     --------
    True     False    PSCustomObject                           System.Object

    Almost all objects in PS are either psobject or scustomobject.

    Learn about the pipeline:

    help about_pipeline


    Sunday, April 30, 2017 9:01 AM
  • I find your response rude and insulting. If you don't understand the question, don't bother responding.
    Monday, May 1, 2017 7:33 AM
  • What jrv is trying to explain (albeit a bit indelicately) is that your question(s) seem to reveal some fundamental misunderstandings about how PowerShell works. Until those misunderstandings are cleared up, the questions are, of necessity, going to be somewhat nonsensical.

    It isn't the purpose of this forum (and we don't have the resources, quite frankly) to "unteach" these fundamental misunderstandings and redesign code.

    Instead, we recommend starting with the basics and do as many PowerShell tutorials as you can and immerse yourself in the fundamentals. We have all had to do this -- there's no shortcut. An analogy is that you can't immediately start with algebra without a background in basic mathematics. You could try, I suppose, but it will be a very frustrating and slow experience (as seems to be the case by your responses).

    -- Bill Stewart [Bill_Stewart]

    Monday, May 1, 2017 1:52 PM