regex - Powershell:Get-EventLog 输出上的正则表达式并找到最大数

Question

我需要从这个命令的输出中提取一个特定的数字:

Get-EventLog "application" | Where-Object {$_.EventID -eq 6006}

示例输出是:

Index Time          EntryType   Source                 InstanceID Message
----- ----          ---------   ------                 ---------- -------
18297 May 15 18:49  Warning     Wlclntfy               2147489654 The winlogon notification subscriber <Profiles> took 60 second(s) to handle the notification event (Logon).
11788 Jan 31 08:11  Warning     Wlclntfy               2147489654 The winlogon notification subscriber <Profiles> took 68 second(s) to handle the notification event (Logon).
5794 Oct 16 09:41  Warning     Wlclntfy               2147489654 The winlogon notification subscriber <Sens> took 225 second(s) to handle the notification event (Logoff).
5596 Oct 11 08:03  Warning     Wlclntfy               2147489654 The winlogon notification subscriber <Profiles> took 69 second(s) to handle the notification event (Logon).
2719 Aug 30 07:50  Warning     Wlclntfy               2147489654 The winlogon notification subscriber <Profiles> took 65 second(s) to handle the notification event (Logon).

我实际需要做的是提取 <Profiles> 报告的秒数事件，并找出最大的一个。我已经弄清楚了 (?<=<Profiles> took )(\d+)将只提取我需要的数字，但我不确定如何继续实际提取它们。我已经尝试将其通过管道传输到 Select-String -pattern，但它根本不返回任何内容。

Answer 1

您需要 $matches 内置变量。 $matches[0] 是匹配正则表达式的文本，$matches[1] .. $matches[n] 是匹配的括号表达式(如果有任何).遗憾的是，我的机器上没有任何 EventID=6006，所以我在没有测试的情况下这样做，但这应该从排序的秒数列表中选择最后一项:

Get-EventLog "application" | 
    Where-Object {$_.EventID -eq 6006} | 
    Where-Object { $_.Message -match "<Profiles> took (\d*) second" } |
    foreach { [int]$matches[1] } |
    sort |
    select -last 1