How to parse Powershell event logs?

[HackerHurricane]

I am trying to read the DETAILS: section of the Powershell logs in Splunk to produce reports and split out each line:

    HostName=Windows PowerShell ISE Host
    HostVersion=2.0
    HostId=086c4ff9-071c-410f-a317-041e41e7dfb9
    EngineVersion=2.0
    RunspaceId=8908cce5-3524-488e-83a3-b9eaa3a50a27
    PipelineId=7
    CommandName=
    CommandType=Script
    ScriptName=
    CommandPath=
    CommandLine=

What happens when you split is you get some odd space or new line character that is not filtering out so the results look like this

CommandPath=    CommandLine=

It's not a space, blank, /r, /n

Anyone got any ideas?

Looks like this:

09/24/2014 02:13:54 PM LogName=Windows PowerShell SourceName=PowerShell EventCode=501 EventType=4 Type=Information ComputerName=MY-SYSTEM TaskCategory=Command Lifecycle OpCode=Info RecordNumber=1053 Keywords=Classic Message=Command "" is Stopped.
NewCommandState=Stopped SequenceNumber=230 HostName=ConsoleHost HostVersion=4.0 HostId=3f2ddea1-01c3-4f90-ae5b-bf0beac2093d EngineVersion=4.0 RunspaceId=9cf73319-1b33-412f-ab96-a24018e59bb6 PipelineId=33 CommandName= CommandType=Script ScriptName= CommandPath= CommandLine=

[HackerHurricane · Accepted solution]

I fixed it with this:

| eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!")

Never had to do this with the Windows Logs... odd return messing up things.

Works:
index=Workstation LogName="Powershell" | eval Message=split(Message,". ") | eval Message=mvindex(Message,0) | eval MessageA=split(_raw,"Details:") | eval Message1=mvindex(MessageA,1) | eval Message1 = replace (Message1,"[\n\r]","!!") | eval MessageC=split(Message1,"!!") | eval Message2=mvindex(MessageC,2) | eval Message3=mvindex(MessageC,3) | eval Message4=mvindex(MessageC,4) | eval Message4=split(Message4,"=") | eval PS_Ver=mvindex(Message4,1) | eval Message5=mvindex(MessageC,5) | eval Message6=mvindex(MessageC,6) | eval Message6=split(Message6,"=") | eval Engine_Ver=mvindex(Message6,1) | eval Message7=mvindex(MessageC,7) | eval Message8=mvindex(MessageC,8) | eval Message8=split(Message8,"=") | eval PLine_ID=mvindex(Message8,1) | eval Message9=mvindex(MessageC,9) | eval Message9=split(Message9,"=") | eval Command_Name=mvindex(Message9,1) | eval Message10=mvindex(MessageC,10) | eval Message10=split(Message10,"=") | eval Command_Type=mvindex(Message10,1) | eval Message11=mvindex(MessageC,11) | eval Message11=split(Message11,"=") | eval Script_Name=mvindex(Message11,1) | eval Message12=mvindex(MessageC,12) | eval Message12=split(Message12,"=") | eval Command_Path=mvindex(Message12,1) | eval Message13=mvindex(MessageC,13) | eval Message13=split(Message13,"=") | eval Command_Line=mvindex(Message13,1) | table _time, host, ComputerName, TaskCategory, Message, PS_Ver, Engine_Ver, PLine_ID, Command_Name, Command_Type, Script_Name, Command_Path, Command_Line

[aaronclf]

This was VERY helpful - thanks!! I'm finding that the data Splunk ingests for PowerShell events (i.e. 4103, 4104) is very sloppy. Fields are not getting extracted, etc. Any idea on how I can resolve this? There doesn't seem to be a proper "Splunk_TA_PowerShell" with props.conf & tranforms.conf to clean up the PowerShell event data - am I wrong? Let me know if you know of a solution, or good resource. Thanks!

[sk314]

How are you trying to split it?