spliting a string after the second ":"

Question

I'm trying to get text from a Get-WinEvent messageblock, normally I simply use this to get the first sentence:

($_.Message).split(".")[0]

This works fine if the first part is seperated by a .

The Message-Block looks like this:

Remotedesktopdienste: Die Sitzungsanmeldung war erfolgreich:

Benutzer: testlab\testuser.local
Sitzungs-ID: 1
Quellnetzwerkadresse: LOKAL.

I try to extract only the part Remotedesktopdienste: Die Sitzungsanmeldung war erfolgreich: (including the : would be perfect, but not mandatory)

Simply using the : as delimiter did not work (the second part is missing).

After that, I tried to use

($_.Message).split(':',2)[0]

Should be the second : in the message-block, this gives Remotedesktopdienste

Another idea was to use

($_.Message).split('[\r\n]',2)[0]

to use the second new line, also no success with that, the result is Remotedesktopdie

something like this should work: ($_.Message).split("`r")[0] — Jayvee, Feb 22 '18 at 09:46
... or ``n`. Keep in mind, PowerShell doen't escape using `\``, it uses the backtick ```` Oh crap that code highlighting.... What I want to say: Backslash (Schraegstrich) doesn't work as escape char in PS. Use the backtick (Apostroph or ho you'd call it.) — Clijsters, Feb 22 '18 at 09:48
Jayvee your solution works, i use `($_.Message).split("`r")[0]` , works fine. — Peter Core, Feb 22 '18 at 12:58

Guenther Schmitz · Accepted Answer · 2018-02-22T12:10:36.363

so you want to split by newline:

 $MessageArray = $Message.Split("`n")

and then you can iterate through it

$Counter = 0
$MessageBody = ""
foreach($Line in $MessageArray) {
     if($Counter -eq 0) {
          $FirstLine = $Line
     } else {
          $MessageBody += $Line + "`n"
     }
     $Counter++
}

Result is: $FirstLine has your first line .. $MessageBody has the rest of the message

Update: you can even do it with this onliner

 $FirstLine,$MessageBody = $Message.Split("`n")

spliting a string after the second ":"

1 Answers1