协助将列数据从 Import-CSV 拆分为多列

Question

我使用 import-csv 命令导入 CSV：

$P = Import-Csv "C:\MyCSV.csv"

然后我运行“Get-Member”：

$P | Get-Member

输出：

名称 MemberType 定义 ---- ---------- ---------- Equals Method bool Equals(System.Object obj) GetHashCode 方法 int GetHashCode() GetType 方法类型 GetType() ToString 方法字符串 ToS​​tring() 消息注释属性字符串消息=ABC 1234 DEFGH 123:3212 IJKLM NOPQRST 23\13\19 ABC1234 0978AJD

然后我运行“格式表”：

$P | Format-Table

输出：

信息 -------- ABC 1234 DEFGH 123:3222 IJKNM NOPQRHT 23\13\19 ABC1234 0978AJD... BAC 3214 DEFAH 123:3422 IJFLM NOPQRAT 23\13\18 ABC1234 0978AJD... CEC 1534 DEFIH 123:3312 IJALM NOPQRFT 23\13\17 ABC1234 0978AJD... 3BC 1144 DAFGH 123:3612 IJZLM NOPQRGT 23\13\16 ABC1234 0978AJD...

我想通过用空格分隔来进一步分割这个输出。我不关心正确命名每个新列。我只是希望能够选择特定文本所属的任何列标题并将该输出导出到新的 CSV。

理想输出：

列 1 列 2 列 3 列 4 等 -------- ------- -------- -------- ABC 1234 DEFGH 123:3222 等

所以我可以运行如下命令：

select Column5,Column8

或类似的命令

select Column15,Column58

谁能帮我解决这个问题？

Answer 1

这应该可以完成工作：

# fake reading in a CSV file as text
#    in real life, use Get-Content
$InStuff = @'
Message
ABC 1234 DEFGH 123:3222 IJKNM NOPQRHT 23\13\19 ABC1234 0978AJD
BAC 3214 DEFAH 123:3422 IJFLM NOPQRAT 23\13\18 ABC1234 0978AJD
CEC 1534 DEFIH 123:3312 IJALM NOPQRFT 23\13\17 ABC1234 0978AJD
3BC 1144 DAFGH 123:3612 IJZLM NOPQRGT 23\13\16 ABC1234 0978AJD
'@ -split [environment]::NewLine

$ColCount = $InStuff[1].Split(' ').Count

$Collection = $InStuff |
    Select-Object -Skip 1 |
    ConvertFrom-Csv -Delimiter ' ' -Header (1..$ColCount).ForEach({"Column_$_"})

$Collection |
    Select-Object -Property 'Column_3', 'Column_7'

输出：

列_3 列_7 -------- -------- DEFGH 23\13\19 德法 23\13\18 DEFIH 23\13\17 达夫 23\13\16

它的作用：

• 将文件读取为文本文件，而不是 CSV 文件
• 计算列数
• 跳过第一行
• 创建 CSV 导入
  • 将分隔符设置为<space>
  • 将标头设置为1..$ColCount的范围
• 筛选所需列

Answer 2

李，我目前无法编辑自己的帖子，因为我的声誉太低 -_-。因此，我将用您要求的信息回复帖子：

为了进一步了解，这是我当前不起作用的代码：

    $InStuff = Get-Content -Path 'MyCSV.csv'

    $ColCount = $InStuff[1].Split(' ').Count

    $Collection = $InStuff |
        Select-Object -Skip 1 |
        ConvertFrom-Csv -Delimiter ' ' -Header         (1..$ColCount).ForEach({"Column_$_"})

$Collection

输出。如您所见，除 Column_1 之外的所有列都是空的：

Column_1   : <134>Dec 13 13:50:23 10.137.119.42 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:23 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy625 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy625 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   : 
...
Column_1   : <134>Dec 13 13:50:18 10.137.119.42 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:18 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy626 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy626 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   : 
...
Column_1   : <134>Dec 13 13:50:14 10.137.118.22 MSWinEventLog 1 Security 123456789 
Thu Dec 13 13:50:14 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy627 N/A 
Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on 
an object.    Subject :   Security ID:  S-123456  Account Name:  dy627 Account 
Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object 
Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   
Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write 
Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX- 
XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   
Parameter 1:  -   Parameter 2:   123456
Column_2   : 
Column_3   : 
Column_4   : 
Column_5   : 

正如我之前所说，我认为问题在于我不知道如何使用更新的语法重新实现 '-split [environment]::NewLine' 命令。如你所见，它不见了。我认为这是问题的原因。

当我按照您的建议输入原始文本时，整个前 3 行，您的语法按预期正常工作。

$InStuff = @'
Message
<134>Dec 13 13:50:23 10.137.119.42 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:23 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy625 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy625 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
<134>Dec 13 13:50:18 10.137.119.42 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:18 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy626 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy626 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
<134>Dec 13 13:50:14 10.137.118.22 MSWinEventLog 1 Security 123456789 Thu Dec 13 13:50:14 2018 4662 Microsoft-Windows-Security-Auditing MyCompany\dy627 N/A Success Audit mydc1.dy625.com Directory Service Access  An operation was performed on an object.    Subject :   Security ID:  S-123456  Account Name:  dy627 Account Domain:  MyCompany   Logon ID:  XXXXXXXX   Object:   Object Server:  DS   Object Type:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Object Name:  %{XXXXXXXX-XXXXXXXX-XXXXXXXX}   Handle ID:  0x0    Operation:   Operation Type:  Object Access   Accesses:  Write Property  Access Mask:  0x20   Properties:  Write Property {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX} {XXXX-XXXX-XXXXX}  {XXXX-XXXX-XXXXX}   Additional Information:   Parameter 1:  -   Parameter 2:   123456
'@ -split [environment]::NewLine

    $ColCount = $InStuff[1].Split(' ').Count

   $Collection = $InStuff |
        Select-Object -Skip 1 |
        ConvertFrom-Csv -Delimiter ' ' -Header     
    (1..$ColCount).ForEach({"Column_$_"})

    $Collection |
        Select-Object -Property 'Column_3', 'Column_7'

输出：

$Collection |
    Select-Object -Property 'Column_3', 'Column_7'

Column_3 Column_7
-------- --------
13:50:23 Security
13:50:18 Security
13:50:14 Security

同样，我认为问题在于我不知道如何实现'-split [environment]::NewLine'command。

$InStuff = Get-Content -Path 'MyCSV.csv' -split [environment]::NewLine

错误：

Get-Content : A parameter cannot be found that matches parameter name 'split'.

无论如何，我希望这能阐明这个问题。