Question

我使用import-csv命令导入CSV：

$P = Import-Csv "C:\MyCSV.csv"

然后我运行'Get-Member'：

$P | Get-Member

输出：

Name        MemberType   Definition
----        ----------   ----------
Equals      Method       bool Equals(System.Object obj)
GetHashCode Method       int GetHashCode()
GetType     Method       type GetType()
ToString    Method       string ToString()
Message     NoteProperty string Message=ABC 1234 DEFGH 123:3212 IJKLM         NOPQRST 23\13\19 ABC1234 0978AJD

然后我运行“格式表”：

$P | Format-Table

输出：

Message
-------
ABC 1234 DEFGH 123:3222 IJKNM NOPQRHT 23\13\19 ABC1234 0978AJD...
BAC 3214 DEFAH 123:3422 IJFLM NOPQRAT 23\13\18 ABC1234 0978AJD...
CEC 1534 DEFIH 123:3312 IJALM NOPQRFT 23\13\17 ABC1234 0978AJD...
3BC 1144 DAFGH 123:3612 IJZLM NOPQRGT 23\13\16 ABC1234 0978AJD...

我想通过按空格定界进一步拆分此输出。我不在乎正确命名每个新列。我只希望能够选择某些文本所属的列标题并将其输出到新的CSV。

理想的输出：

Column1 Column2 Column3 Column4  etc                                                                                                                                                                                       
------- ------- ------- -------                                                                                                                                                                                                      
ABC     1234    DEFGH   123:3222 etc

然后我可以运行以下命令：

select Column5,Column8

或类似的命令

select Column15,Column58

有人可以帮助我吗？

Answer 1

这应该可以完成工作：

# fake reading in a CSV file as text
#    in real life, use Get-Content
$InStuff = @'
Message
ABC 1234 DEFGH 123:3222 IJKNM NOPQRHT 23\13\19 ABC1234 0978AJD
BAC 3214 DEFAH 123:3422 IJFLM NOPQRAT 23\13\18 ABC1234 0978AJD
CEC 1534 DEFIH 123:3312 IJALM NOPQRFT 23\13\17 ABC1234 0978AJD
3BC 1144 DAFGH 123:3612 IJZLM NOPQRGT 23\13\16 ABC1234 0978AJD
'@ -split [environment]::NewLine

$ColCount = $InStuff[1].Split(' ').Count

$Collection = $InStuff |
    Select-Object -Skip 1 |
    ConvertFrom-Csv -Delimiter ' ' -Header (1..$ColCount).ForEach({"Column_$_"})

$Collection |
    Select-Object -Property 'Column_3', 'Column_7'

输出：

Column_3 Column_7
-------- --------
DEFGH    23\13\19
DEFAH    23\13\18
DEFIH    23\13\17
DAFGH    23\13\16

它的作用：

以文本文件而不是CSV文件的形式读取文件
获取列数计数
跳过第一行
创建CSV导入
- 将分隔符设置为<space>
- 将标题设置为1..$ColCount
过滤所需的列

Answer 2

李，我目前无法编辑自己的帖子，因为我的声誉太低-_-。因此，我将用您要求的信息回复该帖子：

为了进一步了解，这是我当前无法使用的代码：

    $InStuff = Get-Content -Path 'MyCSV.csv'

    $ColCount = $InStuff[1].Split(' ').Count

    $Collection = $InStuff |
        Select-Object -Skip 1 |
        ConvertFrom-Csv -Delimiter ' ' -Header         (1..$ColCount).ForEach({"Column_$_"})

$Collection

输出。如您所见，除Column_1以外的所有列均为空：

Column_1   : <134>Dec 13 13:50:23 10.137.119.42 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:23 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy625 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy625 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   : 
...
Column_1   : <134>Dec 13 13:50:18 10.137.119.42 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:18 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy626 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy626 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   : 
...
Column_1   : <134>Dec 13 13:50:14 10.137.118.22 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:14 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy627 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy627 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   :

如前所述，我认为问题在于我不知道如何使用更新的语法重新实现'-split [environment]::NewLine'命令。您可以看到它丢失了。我认为这是问题的原因。

当我按照您的建议输入原始文本时，在前三行中，您的语法可以按预期正常工作。

$InStuff = @'
Message
<134>Dec 13 13:50:23 10.137.119.42 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:23 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy625 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy625 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
<134>Dec 13 13:50:18 10.137.119.42 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:18 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy626 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy626 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
<134>Dec 13 13:50:14 10.137.118.22 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:14 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy627 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy627 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
'@ -split [environment]::NewLine

    $ColCount = $InStuff[1].Split(' ').Count

   $Collection = $InStuff |
        Select-Object -Skip 1 |
        ConvertFrom-Csv -Delimiter ' ' -Header     
    (1..$ColCount).ForEach({"Column_$_"})

    $Collection |
        Select-Object -Property 'Column_3', 'Column_7'

输出：

$Collection |
    Select-Object -Property 'Column_3', 'Column_7'

Column_3 Column_7
-------- --------
13:50:23 Security
13:50:18 Security
13:50:14 Security

再次，我认为问题仅在于我不知道如何实现'-split [environment]::NewLine'命令。

$InStuff = Get-Content -Path 'MyCSV.csv' -split [environment]::NewLine

错误：

Get-Content : A parameter cannot be found that matches parameter name 'split'.

无论如何，我希望这可以使问题更加清晰。

协助将数据列从Import-CSV拆分为多个列

2 个答案: