0

I been following this Microsoft doc https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps and I'm trying to write a PowerShell Script that download Audit Log. So far everything is going well but I'm just wondering how can I read User Id from my csv file instead of having a user Id directly in my script?.

This is how my CSV file look right now.

C:\AuditLogSearch\Reference\User.csv

     Name       Email             Id      
................................
1.   Ronaldo    ronaldo@gmail.com   KLIEKN
2.   Messi      messi@gmail.com     LEK89K
3.   LeBron     lebron@gmail.com    IKNLM9

I was hard coding like this in the script and it's working fine but

$Global:user = "KLIEKN", "LEK89K", "IKNLM9",

Search-UnifiedAuditLog -SessionId $sessionID -SessionCommand ReturnLargeSet -UserIds $user

I don't think that'll be good idea so I try to do read it from my CSV file like this

$Global:userPath = "C:\AuditLogSearch\Reference\User.csv"

function Log-Search {

  Import-Csv $userPath | ForEach-Object  -Property @{
        $userId = $($_.Id) 
    }  

Search-UnifiedAuditLog -SessionId $sessionID -SessionCommand ReturnLargeSet -UserIds $userId
}

but I'm getting this error

A null key is not allowed in a hash literal.

I'll be really appreciated any help or suggestion.

ziico
  • 449
  • 8
  • 23

2 Answers2

1

{} defines a [ScriptBlock] — which is what you'd pass to the ForEach-Object cmdlet to be invoked for each element — whereas @{} defines a [Hashtable]. $userId is $null because you have not assigned a value, so where you have...

@{
    $userId = $($_.Id) 
}

...you are trying to define a [Hashtable] with an element with a key of $null, hence the error.

There is also no such -Property parameter of ForEach-Object, so when you remove "-Property @", you end up with a valid script...

Import-Csv $userPath | ForEach-Object {
    $userId = $($_.Id) 
}

This is reading your CSV file but not yet passing the data to your Search-UnifiedAuditLog call. There are several ways to retrieve the Id field of each CSV record, but the shortest transformation from the previous snippet would be...

Import-Csv $userPath | ForEach-Object {
    $_.Id
}

...which can be rewritten using the -MemberName parameter...

Import-Csv $userPath | ForEach-Object -MemberName Id

...and then all that's left is to store the pipeline results in $userId...

$userId = Import-Csv $userPath | ForEach-Object -MemberName Id

By the way, the CSV data you posted cannot be readily parsed by Import-Csv. If possible, save your data without the second line and using comma or tab as the delimiter (the latter being read with Import-Csv ... -Delimiter "`t"); otherwise, the script will have to do some manipulation before it can read the data.

Lance U. Matthews
  • 15,725
  • 6
  • 48
  • 68
  • Hi..Thank you for this but I'm not sure what you mean by Saving my file without the second line and using comma or tab as the delimiter. Can you pls provide some example pls. – ziico Dec 05 '21 at 15:32
  • so you saying this code "Import-Csv $userPath | ForEach-Object -MemberName Id" will not read all my Ids from Excel properly ? – ziico Dec 05 '21 at 15:39
  • btw those are my list and I have three user in my csv 1.Ronaldo 2.Messi and 3.Lebron. – ziico Dec 05 '21 at 15:44
  • 1
    You should remove the second line (`................................`) from your CSV file because otherwise `Import-Csv` will treat it as data. Also, `Import-Csv` only works with single-character delimiters, so you'll need to save your file with such a delimiter (such as comma or tab) because, at least as it appears in the question, you have multiple spaces between your fields and `Import-Csv ... -Delimiter ' '` will read that as more than three columns. `$userId = Import-Csv $userPath | ForEach-Object -MemberName Id` will retrieve the `Id` values and store them in `$userId`. – Lance U. Matthews Dec 05 '21 at 23:24
0

Try this perhaps?

$userId=@()
Import-Csv $userPath | ForEach-Object {
    $userId += $_.Id
}

or

$userId = Import-Csv $userPath | Select-Object -ExpandProperty Id
Captain_Planet
  • 1,228
  • 1
  • 12
  • 28
  • 4
    [Try to avoid using the increase assignment operator (`+=`) to create a collection](https://stackoverflow.com/a/60708579/1701026) as might become pretty expensive. – iRon Dec 05 '21 at 08:37