Parsing Raw Data and Log Files (Part 2)

by May 31, 2021

In the previous tip we explained that most log files can be treated as CSV files and read by Import-Csv. All you need to do is tell Import-Csv where your log file differs from standard CSV, and for example define a different delimiter or supply missing headers.

One log file format however is hard to parse: fixed-width columns. In this case, there is no single delimiter character to use. Instead, the data uses fixed width strings.

To illustrate this type of data, on Windows run the utility qprocess.exe. It returns fixed-width data (listing the running processes, their owners and their connecting sessions). Below example was taken from a German system but the localized column headers aren’t important here. What’s more important is that each column uses a fixed string width rather than a single delimiter, so ConvertFrom-Csv cannot read the data:

PS> qprocess
>tobia                 console              1   9332  dptf_helper.exe
>tobia                 console              1   9352  mbamtray.exe
>tobia                 console              1   9440  sihost.exe
>tobia                 console              1   9472  svchost.exe 

PS> qprocess | ConvertTo-Csv 
#TYPE System.String

With fixed width data, you can however use a simple regex to replace the variable whitespace with a fixed-width delimiter:

PS> (qprocess) -replace '\s{1,}',','

Now you get valid CSV. And since qprocess returns an array of strings, you could fine-tune the data a bit and for example trim away unwanted characters from each line:

PS> (qprocess).TrimStart(' >') -replace '\s{1,}',','

Twitter This Tip! ReTweet this Tip!