Logapparser查询netapp日志

时间:2018-04-09 06:06:12

标签: powershell logparser

我正在尝试使用PowerShell为NetApp日志编写日志解析器。

脚本如下:

$logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$query = “SELECT TimeCreated  SystemTime,EventID,EventName,Computer,ComputerUUID,EventCategoryName,SourceName,EventData Data INTO D:\Temp\audit_EUPNPSVM-SCM-FC-NAS_D2018-01-09-T10-32-49_0000000000.csv FROM D:\Temp\audit_EUPNPSVM-SCM-FC-NAS_D2018-01-09-T10-32-49_0000000000.evtx" WHERE EventData(Data Name= 'ObjectName')
& $logparser -i:evt -o:csv $query
$ps.WaitForExit()
$ps.ExitCode;

我收到错误:

PS C:\> C:\script\test2.ps1
At C:\script\test2.ps1:2 char:279
+ ... 00000000.evtx" WHERE EventData(Data Name= 'ObjectName')
+                    ~~~~~
Unexpected token 'WHERE' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : UnexpectedToken

0 个答案:

没有答案