使用PowerShell按日期排序CSV输入数据

Question

我正在尝试使用PowerShell对目录中的CSV文件集合进行排序,然后将结果导出到新的单个CSV文件.

我的代码执行没有错误,但结果没有正确排序.

我的源数据看起来像这样(这是一个测试样本):

"TimeCreated","TargetUserSID","UserName","Domain","Message","Remark"
"04.12.2017 13:56:56","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 13:56:48",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:48",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:34",,"User123","testlab.internal","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:29:49",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:29:49",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:27:27","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"08.11.2017 09:24:58",,"","","Fehler beim Anmelden eines Kontos","Failed Login !"
"08.11.2017 09:23:14",,"","","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:25:35",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:25:35",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:23:20","S-1-5-21-66666666-777777777-888888888-99999","User123","testlab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:23:14","S-1-5-21-2025377670-2384379295-2560266631-1005","Admin","TestClientWin7","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:22:44",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38",,"Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:20:28",,"Admin","TestClientWin7","Fehler beim Anmelden eines Kontos","Failed Login !"
"01.12.2017 11:39:17",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"01.12.2017 11:39:17",,"User123","testlab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"

我的结果如下:

"TimeCreated","TargetUserSID","UserName","Domain","Message","Remark"
"01.12.2017 11:39:17","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"01.12.2017 11:39:17","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:20:28","","Admin","TestClientWin7","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 10:22:38","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:38","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:22:44","","Admin","TestClientWin7","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:23:14","S-1-5-21-66666666-777777777-888888888-99999","Admin","TestClientWin7","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:23:20","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:25:35","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:25:35","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:27:27","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"04.12.2017 10:29:49","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 10:29:49","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Interactive (logon at keyboard and screen of system)"
"04.12.2017 13:56:34","","User123","tetslab.internal","Fehler beim Anmelden eines Kontos","Failed Login !"
"04.12.2017 13:56:48","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:48","","User123","tetslab.internal","Ein Konto wurde erfolgreich angemeldet","Workstation unlocked"
"04.12.2017 13:56:56","S-1-5-21-964984727-670836246-1844936127-10903","User123","tetslab.internal","Benutzerinitiierte Abmeldung","User initiated Logoff."
"08.11.2017 09:23:14","","","","Fehler beim Anmelden eines Kontos","Failed Login !"
"08.11.2017 09:24:58","","","","Fehler beim Anmelden eines Kontos","Failed Login !"

这是我的代码:

$SortingCSV = @()
Get-ChildItem "c:\temp\*.csv" | ForEach-Object{
    $SortingCSV += Import-Csv $_
}
$SortingCSV | Sort-Object TimeCreated | Export-Csv -NoTypeInformation -Force -Encoding UTF8 "c:\temp\sorted.csv"

Answer 1

从CSV导入的字段是字符串,因此它们按字符串顺序排序,而不是按日期顺序排序,因此排序绝对正确,而不是您所期望的.您需要计算一个合适的DateTime值Sort-Object来使用以获取按日期顺序排序的行.我还建议不要在循环中追加数组.

$pattern = 'dd\.MM\.yyyy HH:mm:ss'
$culture = [Globalization.CultureInfo]::InvariantCulture

Get-ChildItem 'C:\temp\*.csv' |
    ForEach-Object { Import-Csv $_.FullName } |
    Sort-Object { [DateTime]::ParseExact($_.TimeCreated, $pattern, $culture) } |
    Export-Csv 'C:\temp\sorted.csv' -Encoding UTF8 -NoType -Force