Jared

Don’t include the known value ’email’ in the results.

cat access.log | grep utm_medium | grep -v "utm_medium=email" | sed -n 's/.*utm_medium=\([^&]*\).*/\1/p'

$startDate = (Get-Date -Year 2023 -Month 8 -Day 1).Date # .Date makes it midnight
$endDate = (Get-Date -Year 2023 -Month 8 -Day 20).Date

Get-WinEvent -FilterHashtable @{logname = 'Application'; id = 4} -MaxEvents 25 | Where-Object { $_.Timecreated -ge $startDate -and $_.Timecreated -lt $endDate } | where message -match "Message to find" | Format-Table -wrap

Add-Type -Path "C:\Temp\Hashids.net.1.0.0\lib\net40\Hashids.net.dll"

$orgids = New-Object HashidsNet.Hashids("orgkey",3, "abcdefghjkmnpqrstuvwxyz23456789")
$userids = New-Object HashidsNet.Hashids("accountkey",6, "abcdefghjkmnpqrstuvwxyz23456789")

$orgids.Encode(1);
$userids.Encode(1);

Get-WinEvent -FilterHashtable @{logname = 'System'; id = 1074, 6005, 6006, 6008} -MaxEvents 6 | Format-Table -wrap

Search for text ‘term’ unless it is followed by a tab character.

term(?!\t)