I am working on a script to pull metrics from a log file. Here is an example from the log.
2/21/2022 3:29 PM: Requested username - Found disabled account with matching CATIID named username - Account username reactivated
3/21/2022 3:37 PM: username - No account found. Creating new account.
4/26/2022 1:25 PM: username- Disabled account found. Re-enabling
account.
4/26/2022 1:25 PM: username - Active account found. Added to requested groups and updated charge code.
4/26/2022 1:25 PM: username - Disabled account found. Re-enabling account.
I need to be able to filter this to only count the number of times "Reactivated or Re-enabling" appears but also only for the month we are auditing.
Expected count from above would be 2 for the month of April.
I attempted to start filtering by using
$acc1 = Get-Content $accountcreatedpath | Select-String -pattern "$reactivationmonth/"
$acc2 = $acc1 | Select-String -pattern "/2022"
$acc3 = $acc2 | Select-String -NotMatch "$reactivationmonth/2022"
$accountscreated1 = ($acc3).Count
However this will miss any entries that occur when the month and day are the same. Any help greatly appreciated.
You can use
$acc1 = '2/21/2022 3:29 PM: Requested username - Found disabled account with matching CATIID named username - Account username reactivated
3/21/2022 3:37 PM: username - No account found. Creating new account.
4/26/2022 1:25 PM: username- Disabled account found. Re-enabling
account.
4/26/2022 1:25 PM: username - Active account found. Added to requested groups and updated charge code.
4/26/2022 1:25 PM: username - Disabled account found. Re-enabling account.'
$reactivationmonth=4
$rx = "(?m)^$reactivationmonth/\d{1,2}/20\d{2}.*?\b(Reactivated|Re-enabling)\b"
([regex]::Matches($acc1, $rx )).count
Output is 2. See the regex demo.
Details:
(?m)^ - start of a line ((?m) equals RegexOptions.Multiline option)$reactivationmonth - the month/ - a / char\d{1,2} - one or two digits/20 - a /20 text\d{2} - two digits
-.*? - any zero or more chars other than newline chars as few as possible\b(Reactivated|Re-enabling)\b - a whole word Recativated or Re-enabling.