Reputation: 45
I've got a nice working powershell function called PSO. The PSO function searches for one or more specific windows processes based on the given input/parameter. When a procesname matches the searchparameter it exports/appends the process owner and more info to a csv file. All good so far.
Now I really like to add date and time info to each line PowerShell writes to the csv. I've been struggling with it for a while now. I've got somehting simular working in VBScript, but i'm really starting to like powershell and like to see and learn more.
Below The PSO Function, I assume this is the area where Date and Time should be generated and added... right?
Function Get-PSO($searchString)
# http://powershell.com/cs/blogs/tips/archive/2009/12/17/get-process-owners.aspx
# Usage: Get-PSO * OR Get-PSO exp*,*paint*,calc*,notepad*
# Sample Export2csv: Get-PSO notepad* | Export-CSV $env:userprofile\desktop\export.csv -Append
# A few date/time formats for later use... i hope
$date=(Get-Date -format "yyyy-MM-d")
$time=(Get-Date -format "HH:mm:ss")
$datetime=(Get-Date -format "yyyy-MM-d HH:mm")
$foundProcess = ps $searchString -ea silentlycontinue
if($foundProcess -eq $null) { return; }
$foundprocess | % {
gwmi Win32_Process -Filter ("Handle={0}" -f $_.id ) |
% { Add-Member -TypeName Type -InputObject $_ -MemberType NoteProperty -Name Owner -Value ($_.GetOwner().User) -PassThru } |
# See below my last attempt to get this tot work
# % { Add-Member -TypeName Type -InputObject $_ -MemberType NoteProperty -Name Owner -Value ($_.GetOwner().User) -MemberType NoteProperty -Name Date -Value $date -PassThru } |
select Name, Handle, Owner, Type
}
When I run the function ; Get-PSO notepad* | Export-CSV $env:userprofile\desktop\export.csv -Append) I get the following result:
Name;Handle;Owner;Type
notepad++.exe;7736;Dave;
I like to Add Date/Time and the result should look something like:
Name;Handle;Owner;Date;Time;DateTime;Type
notepad++.exe;7736;Dave;5-4-2015;20:07;5-4-2015 20:07;
Anyone? some help or ideas would be very much appreciated.
Upvotes: 3
Views: 5126
Reputation: 8616
Is this what you are looking for?
Function Get-PSO($searchString) {
# http://powershell.com/cs/blogs/tips/archive/2009/12/17/get-process-owners.aspx
# Usage: Get-PSO * OR Get-PSO exp*,*paint*,calc*,notepad*
# Sample Export2csv: Get-PSO notepad* | Export-CSV $env:userprofile\desktop\export.csv -Append
# A few date/time formats for later use... i hope
$date=(Get-Date -format "yyyy-MM-d")
$time=(Get-Date -format "HH:mm:ss")
$datetime=(Get-Date -format "yyyy-MM-d HH:mm")
$foundProcess = ps $searchString -ea silentlycontinue
if($foundProcess -eq $null) { return; }
$foundprocess | % {
gwmi Win32_Process -Filter ("Handle={0}" -f $_.id ) |
% {
Add-Member -InputObject $_ -MemberType NoteProperty -Name Owner -Value ($_.GetOwner().User) -PassThru
Add-Member -InputObject $_ -MemberType NoteProperty -Name Date -Value $date -PassThru
Add-Member -InputObject $_ -MemberType NoteProperty -Name Time -Value $time -PassThru
Add-Member -InputObject $_ -MemberType NoteProperty -Name DateTime -Value $datetime -PassThru
Add-Member -InputObject $_ -MemberType NoteProperty -Name Type -Value "" -PassThru
} |
select Name, Handle, Owner, Date, Time, DateTime, Type
}
}
Each Add-Member
command adds a property to the individual results. The Name
parameter will be the column name in the exported CSV and the Value
parameter will be the value. The select
command (actually Select-Object
) filters the results to the listed subset of properties.
Alternatively, you could do all of this using just Select-Object and Calculated Properties.
Function Get-PSO($searchString) {
# http://powershell.com/cs/blogs/tips/archive/2009/12/17/get-process-owners.aspx
# Usage: Get-PSO * OR Get-PSO exp*,*paint*,calc*,notepad*
# Sample Export2csv: Get-PSO notepad* | Export-CSV $env:userprofile\desktop\export.csv -Append
# A few date/time formats for later use... i hope
$date=(Get-Date -format "yyyy-MM-d")
$time=(Get-Date -format "HH:mm:ss")
$datetime=(Get-Date -format "yyyy-MM-d HH:mm")
$foundProcess = ps $searchString -ea silentlycontinue
if($foundProcess -eq $null) { return; }
$foundprocess | % {
gwmi Win32_Process -Filter ("Handle={0}" -f $_.id ) |
select-Object Name, Handle,
@{Name='Owner'; Expression={$_.GetOwner().User}},
@{Name='Date'; Expression={$date}},
@{Name='Time'; Expression={$time}},
@{Name='DateTime'; Expression={$datetime}},
@{Name='Type'; Expression={''}}
}
}
Upvotes: 4