Using a WMI string array in Powershell

I can successfully retried remote eventlog entries using Get-WMIObject, but I
can't figure out how to parse through the InsertionStrings array (a string
array according to MSDN library at
http://msdn2.microsoft.com/en-us/library/aa394226.aspx)

This command:
get-wmiobjet -computername REMOTEHOST -query "select * from win32_ntlogevent
where logfile = 'Secuirty'" |select-object InsertionStrings | format-table $_

will return:
InsertionStrings
----------------
{NETWORK SERVICE, NT AUTHORITY, (0x0,0x3E4), SeAuditPrivilege...
{NETWORK SERVICE, NT AUTHORITY, (0x0,0x3E4), 5...}
etc.

But, how do I then parse out individual string entries?

I tried piping using: select-object InsertionStrings | format-table $_[1]
to get the second item, but receive the error:
"Cannot index into a null array"

I've tried several other methods as well, but can't seem to figure this one
out, so I'm hoping someone can help me out...

Thanks in advance...

--
GordT. (CISSP, GCIH, GEEK)

Im not really sure what your goal is... but you can do this:

$entries = get-wmiobject -computername nybba0bps1 -query "select * from
win32_ntlogevent where logfile = 'Security'" |select-object InsertionStrings
foreach($entry in $entries){
# For Property 1
$entry.InsertionStrings[0]
# For Property 2
$entry.InsertionStrings[1]
# and so on and so on
}

or
$entries = get-wmiobject -computername nybba0bps1 -query "select * from
win32_ntlogevent where logfile = 'Security'" |select-object InsertionStrings
$entries[0].InsertionStrings[0] # for a specific entry

--

Brandon Shell
---------------
Stop by my blog some time
http://mybsinfo.blogspot.com/
----------------------------------

"GordT." <GordT@discussions.microsoft.com> wrote in message
news:7D32B781-F69F-4029-812F-1E7332287034@microsoft.com...
>I can successfully retried remote eventlog entries using Get-WMIObject, but
>I
> can't figure out how to parse through the InsertionStrings array (a string
> array according to MSDN library at
> http://msdn2.microsoft.com/en-us/library/aa394226.aspx)
>
> This command:
> get-wmiobjet -computername REMOTEHOST -query "select * from
> win32_ntlogevent
> where logfile = 'Secuirty'" |select-object InsertionStrings | format-table
> $_
>
> will return:
> InsertionStrings
> ----------------
> {NETWORK SERVICE, NT AUTHORITY, (0x0,0x3E4), SeAuditPrivilege...
> {NETWORK SERVICE, NT AUTHORITY, (0x0,0x3E4), 5...}
> etc.
>
> But, how do I then parse out individual string entries?
>
> I tried piping using: select-object InsertionStrings | format-table $_[1]
> to get the second item, but receive the error:
> "Cannot index into a null array"
>
> I've tried several other methods as well, but can't seem to figure this
> one
> out, so I'm hoping someone can help me out...
>
> Thanks in advance...
>
> --
> GordT. (CISSP, GCIH, GEEK)