使用PowerShell按日期排序CSV输入数据

时间：2018-02-06 15:57:43

标签： powershell

我正在尝试使用PowerShell对目录中的CSV文件进行排序，然后将结果导出到新的单个CSV文件。

我的代码执行没有错误，但结果没有正确排序。

我的源数据看起来像这样（这是一个测试样本）：

"TimeCreated","TargetUserSID","UserName","Domain","Message","Remark"
"04.12.2017 13:56:56","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 13:56:48",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:48",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:34",,"User123","testlab.internal","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:29:49",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:29:49",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:27:27","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"08.11.2017 09:24:58",,"","","Fehler beim Anmelden eines Kontos","Failed Login !"
"08.11.2017 09:23:14",,"","","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:25:35",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:25:35",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:23:20","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:23:14","S-1-5-21-2025377670-2384379295-2560266631-1005","Admin","TestClientWin7","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:22:44",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:20:28",,"Admin","TestClientWin7","Fehler beim Anmelden eines Kontos","Failed Login !"
"01.12.2017 11:39:17",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"01.12.2017 11:39:17",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"

我的结果如下：

"TimeCreated","TargetUserSID","UserName","Domain","Message","Remark"
"01.12.2017 11:39:17","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"01.12.2017 11:39:17","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:20:28","","Admin","TestClientWin7","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:22:38","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:23:14","S-1-5-21-66666666-777777777-888888888-99999","Admin","TestClientWin7","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:23:20","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:25:35","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:25:35","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:27:27","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:29:49","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:29:49","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 13:56:34","","User123","tetslab.internal","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 13:56:48","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:48","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:56","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"08.11.2017 09:23:14","","","","Fehler beim Anmelden eines Kontos","Failed Login !"
"08.11.2017 09:24:58","","","","Fehler beim Anmelden eines Kontos","Failed Login !"

这是我的代码：

$SortingCSV = @()
Get-ChildItem "c:\temp\*.csv" | ForEach-Object{
    $SortingCSV += Import-Csv $_
}
$SortingCSV | Sort-Object TimeCreated | Export-Csv -NoTypeInformation -Force -Encoding UTF8 "c:\temp\sorted.csv"

2 个答案:

答案 0 :(得分：5)

从CSV导入的字段是字符串，因此它们按字符串顺序排序，而不是按日期顺序排序，因此排序绝对正确，而不是您所期望的。您需要为DateTime计算正确的Sort-Object值，以便按日期顺序排序行。我还建议不要在循环中追加数组。

$pattern = 'dd\.MM\.yyyy HH:mm:ss'
$culture = [Globalization.CultureInfo]::InvariantCulture

Get-ChildItem 'C:\temp\*.csv' |
    ForEach-Object { Import-Csv $_.FullName } |
    Sort-Object { [DateTime]::ParseExact($_.TimeCreated, $pattern, $culture) } |
    Export-Csv 'C:\temp\sorted.csv' -Encoding UTF8 -NoType -Force

答案 1 :(得分：1)

出现此问题是因为TimeCreated列按字母顺序排序，因为它被解释为字符串值。处理此问题的一种方法是将其转换为DateTime对象。您可以使用计算属性在Select-Object cmdlet中执行此操作：

$SortingCSV | Select -ExcludeProperty TimeCreated @{N='TimeCreated';E={Get-Date $_.TimeCreated}},* | Sort-Object TimeCreated | Export-CSV ..

上面排除了TimeCreated属性，然后使用Get-Date使用相同的名称重新创建它，以返回它包含的字符串值的日期对象。

相关问题
最新问题