I am trying to Search a String from a Variable.
I am dumping Azure Activity Logs in a variable and trying to find a specific line for that log. Here is my codes below.
$log=Get-AzLog -ResourceId "/subscriptions/SubscriptionID/resourceGroups/ResourceGroupName/providers/Microsoft.Sql/servers/qcsqldw/databases/DatabaseName" -StartTime 2020-04-01T00:30
$find=$log | Select-String -Pattern 'Microsoft.Sql/servers/databases/resume/action'
Write-Output $find
I am trying to Search this Line "Action : Microsoft.Sql/servers/databases/resume/action" from the Log
While running the above script I did not got any output.
Please help me on this.
It seems you are searching the the Authorization Action property from your Azure Activity resource logs. If this is the case then you don't need to do any string searching, and simply reference the Authorization.Action property. Get-AzLog will give you a System.Object[], which can just be queried normally with Foreach-Object or Where-Object. You can find out this type information with (Get-AzLog).GetType().FullName.
You could run this query to get all your results with Foreach-Object:
Get-AzLog -ResourceId $id -StartTime 2020-04-01T00:30 | ForEach-Object {$_.Authorization.Action}
Which will give you the Authorization.Action property from all your logs that ran from the start time 2020-04-01T00:30.
If you want to modify this query to search for a specific action, you can filter with Where-Object, then select Authorization.Action from the results:
(Get-AzLog -ResourceId $id -StartTime 2020-04-01T00:30 | Where-Object {$_.Authorization.Action -eq "Microsoft.Sql/servers/databases/resume/action"}).Authorization.Action