When I run this function without specifying the Count Parameter, it asks for the Source, which is expected, then doesn't return the information that the Count switch should return, but if I specify the Count Switch it returns the information I requested.
function Get-EventCounts
{
[CmdletBinding(DefaultParameterSetName = "Count")]
param (
[Parameter(ParameterSetName = "Count", Mandatory = $false)]
[Switch]$Count,
[Parameter(ParameterSetName = "Message", Mandatory = $false)]
[Switch]$Message,
[Parameter(ParameterSetName = "Message", Mandatory = $true)]
[String]$EventID,
[Parameter(ParameterSetName = "Message", Mandatory = $true)]
[Parameter(ParameterSetName = "Count", Mandatory = $true)]
[String]$Source,
[String[]]$DaysBack = ("7", "30", "60")
)
If ($Message)
{
foreach ($int in $DaysBack)
{
$EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
$MessageReturn = $EventList | Sort-Object -Property EventID | Where-Object -Property EventID -EQ $EventID
}
Return $MessageReturn.Message | Select-Object -Unique
}
If ($Count)
{
foreach ($int in $DaysBack)
{
$EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
$UniqueID = $EventList.EventID | Sort | Get-Unique
foreach ($Event in $UniqueID)
{
$Counting = $EventList | Where-Object -Property EventID -Like $Event
$EventArray += @(
[PSCustomObject]@{
EventID = $Event; TimeFrame = $int; Rate = $Counting.Count; PossibleMessage = $($($eventlist | where-object { $_.EventID -eq $event }))[0].Message
}
)
}
}
Return $EventArray
}
}
It seems like you are trying to execute code based on the parameter set name rather than when switches are used. If that is the case, then you can change your if
statement conditions.
function Get-EventCounts
{
[CmdletBinding(DefaultParameterSetName = "Count")]
param (
[Parameter(ParameterSetName = "Count", Mandatory = $false)]
[Switch]$Count,
[Parameter(ParameterSetName = "Message", Mandatory = $false)]
[Switch]$Message,
[Parameter(ParameterSetName = "Message", Mandatory = $true)]
[String]$EventID,
[Parameter(ParameterSetName = "Message", Mandatory = $true)]
[Parameter(ParameterSetName = "Count", Mandatory = $true)]
[String]$Source,
[String[]]$DaysBack = ("7", "30", "60")
)
If ($PSCmdlet.ParameterSetName -eq "Message")
{
foreach ($int in $DaysBack)
{
$EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
$MessageReturn = $EventList | Sort-Object -Property EventID | Where-Object -Property EventID -EQ $EventID
}
Return $MessageReturn.Message | Select-Object -Unique
}
If ($PSCmdlet.ParameterSetName -eq "Count")
{
foreach ($int in $DaysBack)
{
$EventList = Get-EventLog System -Source $Source -After (Get-Date).AddDays(- $int) | select EventID, EntryType, TimeGenerated, Message
$UniqueID = $EventList.EventID | Sort | Get-Unique
foreach ($Event in $UniqueID)
{
$Counting = $EventList | Where-Object -Property EventID -Like $Event
$EventArray += @(
[PSCustomObject]@{
EventID = $Event; TimeFrame = $int; Rate = $Counting.Count; PossibleMessage = $($($eventlist | where-object { $_.EventID -eq $event }))[0].Message
}
)
}
}
Return $EventArray
}
}
If you truly are trying to make decisions based off of the switches, then you would need to set a default value for $Count
or add additional logic for when $Count
is not present.