Untitled

mail@pastecode.io avatar
unknown
plain_text
14 days ago
620 B
2
Indexable
Never
$logFile = "C:\Windows\System32\dns\debug\dnsdebug.log"
$startDate = (Get-Date).AddDays(-7)

$clientQueries = Get-Content -Path $logFile | 
    Where-Object { $_ -match "Query received" -and [datetime]::ParseExact(($_ -split "\|")[0], "yyyy-MM-dd HH:mm:ss.fff", $null) -ge $startDate } |
    ForEach-Object {
        $parts = $_ -split "\|"
        [PSCustomObject]@{
            Timestamp = [datetime]::ParseExact($parts[0], "yyyy-MM-dd HH:mm:ss.fff", $null)
            ClientIP = $parts[1]
            QueryName = $parts[2]
        }
    }

$clientQueries | Group-Object -Property ClientIP | Select-Object Count, Name
Leave a Comment