I am having the script to export the event logs to excel file. While running the script the exported data is saving in excel file. Now I need to save the exported logs in same excel file, but do not overwrite the data. save the new exported data in same excel at bottom of last line of last exported data.
$filter = "*[System[EventID=4740 and Provider[@Name='Microsoft-Windows-Security-Auditing']]]"
$result = Get-WinEvent -LogName Security -FilterXPath $filter | ForEach-Object {
# convert the event to XML and grab the Event node
$eventXml = ([xml]$_.ToXml()).Event
# output the properties you need
[PSCustomObject]@{
EventID = $eventXml.System.EventID
TimeCreated = $eventXml.System.TimeCreated.SystemTime -replace '\.\d .*$'
Computer = $eventXml.System.Computer
TargetUserName = ($eventXml.EventData.Data | Where-Object { $_.Name -eq "TargetUserName"}).'#text'
SubjectUserName = ($eventXml.EventData.Data | Where-Object { $_.Name -eq "SubjectUserName"}).'#text'
HOSTName = ($eventXml.EventData.Data | Where-Object { $_.Name -eq "TargetDomainName"}).'#text'
}
}
# save as CSV file if you like
$result | Export-Csv -Path C:\Daily_Report\$((Get-Date).ToString("dd-MM-yyy")).csv -NoTypeInformation
CodePudding user response:
use -append while exporting the data
# save as CSV file if you like
$result | Export-Csv -Path C:\Daily_Report\$((Get-Date).ToString("dd-MM-yyy")).csv -NoTypeInformation -append