Skip to content

Instantly share code, notes, and snippets.

@rasimmers
Created January 14, 2019 15:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rasimmers/08450e7c5af6601d7471d5e5bb706378 to your computer and use it in GitHub Desktop.
Save rasimmers/08450e7c5af6601d7471d5e5bb706378 to your computer and use it in GitHub Desktop.
Parse XML with dot notation
$log = @"
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
<System>
<Provider Name='Service Control Manager' Guid='{555908d1-a6d7-4695-8e1e-26931d2012f4}' EventSourceName='Service Control Manager'/>
<EventID Qualifiers='16384'>7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime='2019-01-12T16:00:11.920020600Z'/>
<EventRecordID>41452</EventRecordID>
<Correlation/>
<Execution ProcessID='692' ThreadID='828'/>
<Channel>System</Channel>
<Computer>EC2AMAZ-D6OFVS8</Computer>
<Security/>
</System>
<EventData>
<Data Name='param1'>Device Install Service</Data>
<Data Name='param2'>running</Data>
<Binary>44006500760069006300650049006E007300740061006C006C002F0034000000</Binary>
</EventData>
<RenderingInfo Culture='en-US'>
<Message>The Device Install Service service entered the running state.</Message>
<Level>Information</Level>
<Task></Task>
<Opcode></Opcode>
<Channel></Channel>
<Provider>Microsoft-Windows-Service Control Manager</Provider>
<Keywords>
<Keyword>Classic</Keyword>
</Keywords>
</RenderingInfo>
</Event>
"@
[xml]$xml = $log
$xml.Event.RenderingInfo.Message
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment