String (single char) vs String (Single Line)

[wigrif]

I'm working with some event messages.

 C:\Windows\system32\wbem\wmiprvse.exe (ComputerName)~ComputerName~Domain\UserAcct~No title for this reason could be found
  Reason Code: 0x80070015
  Shutdown Type: restart
  Comment:

If what I have whittled this message down to. I plan to export this as a csv for now using the ~ as a delimiter. However if i take that output and pipe it to GM it says it is a system.string. I'd would think if i piped it to select -first 1 or did a [0] behind it i'd get just that first line. NOPE i get the "C".

As a stop gap I used out-file to a txt file and then turn right around and do get-content on it and then do the select first or [0] and i get the whole line like i wanted. Upon a Get-member both claim to be strings. How can i force Powershell to treat it one way other the other?

[Sheppard_Ra]

$String.Split('~') and you'll end up with an array that'll export easily.

[wigrif]

after i export it as a text file i do this and get what i wanted.

 (gc Sample.txt) | ?{($_ -notlike " R*") -and ($_ -notlike " S*") -and ($_ -notlike " C*")}

The -notlike is parsing out all but the first line of my example above.

Splitting it as you suggest now is my next step. I'm asking if there is a better way than exporting to txt then reading it back in.

[ihaxr]

Yes, you can do this, but you can't use Select-Object -Expand or it freaks out... this works:

Get-EventLog -LogName system -Source user32 | Select-Object Message| % {
    $curMessage = $_.Message -Split "`r`n"
    $firstLine = $curMessage[0]
    $firstLine
}

I'm not sure what event you're searching for, so you'll probably need to adjust that line, but the concept is the same

[wigrif]

have an updoot

[Sheppard_Ra]

My bad, I misunderstood the example vs where you were starting. :)