I'm having a little trouble with getting what works in Powershell ISE into a monitor. In the ISE, I'm getting the results that I expect, however Orion seems to be having trouble with taking the resulting array, and joining it into a message. Can someone spot anything I'm missing to make this work as a monitor?
PARAM($computer)
$i = 0
$results = @()
$alerts = @()
$results = get-eventlog `
-logname application `
-source wsh `
-After (Get-Date).AddHours(-2) |`
?{ $_.Message -LIKE "*PagerDuty*" `
-AND $_.Message -Notlike "*OK*" `
-AND $_.Message -NotLike "*event_action`": `"acknowledge*" } |`
Select -last 20 |`
Select-Object * |`
Format-List
ForEach( $Result IN $Results ){
$i++
$result.Message -match '(\"Alert Name\"\: \")(.*?)(?=\",)'
$alerts += $matches[2]
}
$alerts = $($alerts | Sort -Unique) -Join ", "
# $alertsFinal = $alerts | Get-Unique -Join ", "
# $alerts = $alerts | Sort -Unique
# $alertsFinal = [System.String]::Join(', ',$alerts)
IF( !$Alerts ){
$alertFinal = "" }ELSE{
$alertFinal = "Affected Alerts $alerts." }
Write-Output "Statistic: $i"
Write-Output "Message: Orion found $i failed JSON payload send attempts today. $alertFinal"
