Thank you. Would there be some difference other than method between extracting the
message and parsing it vs parsing the xml? I ask because if I parse the xml to get a VM name and save it to a variable it shows System.String. If I do the same from a message it says System.String but the variable from the xml wont work with get-scvirtualmachine.
This is what I came up with to parse the XML
## this gets me the vm from the forwarded events ##
Code: Select all
$event = Get-WinEvent -LogName "ForwardedEvents" -MaxEvents 1
[xml]$xmlEvent = $event.ToXml()
$q = ($xmlevent.Event.EventData.Data -split '[\r\n]')
$ph = $q[0] -split 'to '
$vm = $ph[0]
$node = $ph[1]
$vmfqdn = $q[1]
$vm outputs the vm name as System.String but when I try to use it with
Code: Select all
Get-SCVirtualMachine -VMMServer myvmmserver -Name $VM
it fails even though $vm is showing correct
Now if I try parsing the message like this.
### gets me the node ###
Code: Select all
$event = Get-WinEvent -LogName "ForwardedEvents" -MaxEvents 1
[xml]$xmlEvent = $event.ToXml()
$q = ($xmlevent.Event.EventData.Data -split '[\r\n]')
$ph = $q[0] -split 'to '
$node = $ph[1]
## goes to the node and grabs the latest event ##
$logid = 6101
$logname = "Application"
$string = Get-WinEvent -ComputerName $node -LogName $logname|where {$_.Id -eq $logid}|Select -First 1
$string = $string |Select -ExpandProperty Message
## get the vm name from the log message ##
$arr = $string -split ('"')
$y = $arr[1]
$z = $y.Split(' ')
$vm = $z[0]
$vm outputs the vm name as System.String
This works
Code: Select all
Get-SCVirtualMachine -VMMServer myvmmserver -Name $VM
Thanks.