In the previous tip we explained that most log files can be treated as CSV files and read by Import-Csv. All you need to do is tell Import-Csv where your log file differs from standard CSV, and for example define a different delimiter or supply missing headers.

One log file format however is hard to parse: fixed-width columns. In this case, there is no single delimiter character to use. Instead, the data uses fixed width strings.

To illustrate this type of data, on Windows run the utility qprocess.exe. It returns fixed-width data (listing the running processes, their owners and their connecting sessions). Below example was taken from a German system but the localized column headers aren’t important here. What’s more important is that each column uses a fixed string width rather than a single delimiter, so ConvertFrom-Csv cannot read the data:

 
PS> qprocess
 BENUTZERNAME          SITZUNGSNAME        ID    PID  ABBILD
>tobia                 console              1   9332  dptf_helper.exe
>tobia                 console              1   9352  mbamtray.exe
>tobia                 console              1   9440  sihost.exe
>tobia                 console              1   9472  svchost.exe 
...

PS> qprocess | ConvertTo-Csv 
#TYPE System.String
"Length"
"60" 
... 
 

With fixed width data, you can however use a simple regex to replace the variable whitespace with a fixed-width delimiter:

 
PS> (qprocess) -replace '\s{1,}',','
,BENUTZERNAME,SITZUNGSNAME,ID,PID,ABBILD
>tobia,console,1,9332,dptf_helper.exe
>tobia,console,1,9352,mbamtray.exe
>tobia,console,1,9440,sihost.exe 
... 
 

Now you get valid CSV. And since qprocess returns an array of strings, you could fine-tune the data a bit and for example trim away unwanted characters from each line:

 
PS> (qprocess).TrimStart(' >') -replace '\s{1,}',','
BENUTZERNAME,SITZUNGSNAME,ID,PID,ABBILD
tobia,console,1,9332,dptf_helper.exe
tobia,console,1,9352,mbamtray.exe
tobia,console,1,9440,sihost.exe 
... 
 




Twitter This Tip! ReTweet this Tip!

Anonymous