-
Notifications
You must be signed in to change notification settings - Fork 12
/
FlattenWinEvent.ps1
28 lines (28 loc) · 980 Bytes
/
FlattenWinEvent.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
function FlattenWinEvent {
[CmdletBinding()]
param (
[Parameter(ValueFromPipeline=$true)]
[System.Diagnostics.Eventing.Reader.EventLogRecord[]]
$EventLogRecord
) #param
process {
$EventLogRecord | ForEach-Object {
$EventXml = [xml]$_.ToXml()
$XmlData = $null
if ($XmlData = @($EventXml.Event.EventData.Data)) {
for ($i=0; $i -lt $XmlData.Count; $i++) {
$SplatArgs = @{
InputObject = $_
MemberType = "NoteProperty"
Name = "DATA-$($XmlData[$i].name)"
Value = "$($XmlData[$i].'#text')"
Force = $true
Passthru = $true
}
$_ = Add-Member @SplatArgs
} #for
} #if
$_
} #ForEach EventLogRecord
} #process
} #function FlattenWinEvent