'How to write log parser query with $_.FullName in it in PowerShell
The following PowerShell script works.
Get-ChildItem -Path C:\eventlogs -recurse -Filter *.evtx | foreach { cd $_.DirectoryName; pwd; & 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT -q:ON "SELECT * FROM [$_.FullName] WHERE EventID = '1101'" }
But I want to change the 'Security.evtx' with $_.FullName so the query runs on every file but just change that work. My output is as following:
PS C:\eventlogs> c:\ps\ps1.ps1
Error: Error retrieving files: Error opening file "C:\eventlogs\[application.evtx.FullName]": The system cannot find the file specified.
Error: Error retrieving files: Error opening file "C:\eventlogs\[security.evtx.FullName]": The system cannot find the file specified.
Error: Error retrieving files: Error opening file "C:\eventlogs\[system.evtx.FullName]": The system cannot find the file specified.
Path
----
C:\eventlogs
C:\eventlogs
C:\eventlogs
PS C:\eventlogs>
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
