Search code examples
powershellget-eventlog

Get-Eventlog group by Event and Day

Get-EventLog -Logname system -Source "Microsoft-Windows-GroupPolicy" -EntryType "Information"| group-object -property source | sort-object -property Time -descending

It does group everything together and counts it but I want the count to be also by day.

Results be like:

02.10.2015 10 Microsoft-Windows......
04.11.2016 2  Microsoft-Windows.....
08.11.2016 13 Microsoft-Windows......

and so on.

How can I get the date splitting in there?

Solution

  • You can group by two different properties and we can fabricate a property to hold the day as a string.

    Get-EventLog -Logname system -Source "Microsoft-Windows-GroupPolicy" -EntryType "Information" |
    Add-Member Day -MemberType ScriptProperty -Value { $this.TimeGenerated.ToString('dd.MM.yyyy') } -PassThru |
    Group-Object 'Day', 'Source'