$str = get-item '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log' | Select-String -Pattern 'rejsekort/2015'
$csv = $str | select -expand line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
$group = $csv | group 'cs-uri-stem'



$csv = Import-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ') -Path '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log'


$content = Get-Content '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log'




$csv = foreach($file in '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log') {
    
    $stream = New-Object System.IO.StreamReader -ArgumentList $file

    while($line = $stream.ReadLine()) {
        
        if($line.StartsWith('#')) { continue }

        if($line -match '/cws/Error/DefaultError') {
            $line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
        }

    }
    
    $stream.Close()
}


$group[7].group | sort time | ft time, 'cs-uri-query' -AutoSize

$group.group | foreach { $datetime = "$($_.date) $($_.time)"; $datetime = Get-Date $datetime; $datetime = $datetime.AddHours(1); $_ | Add-Member -MemberType NoteProperty -Name DateTime -Value $datetime.ToString('yyyy-MM-dd HH:mm:ss') }

$group.group | sort datetime | where 'cs-uri-query' -notmatch '\.png' | ft 's-computername', 'time-taken', datetime, 'cs-method', 'cs-uri-query', @{ N='Agent'; E={ 
    $os = $agent = $_.'cs(User-Agent)'

    if($os -match 'Windows') { $os = 'Windows' }
    if($os -match 'iPhone|Darwin') { $os = 'iPhone' }
    if($os -match 'iPad') { $os = 'iPad' }
    if($os -match 'Dalvik|Android') { $os = 'Android' }
    if($os -match 'Mac\+OS\+X') { $os = 'Mac' }
    if($os -match 'Ubuntu') { $os = 'Ubuntu' }
    if($os -match 'Linux') { $os = 'Linux' }

    
    if($agent -match 'chrome') { $agent = 'Chrome' }
    if($agent -match 'Firefox') { $agent = 'Firefox' }
    if($agent -match 'Safari') { $agent = 'Safari' }
    if($agent -match 'Mit%20Rejsekort') { $agent = '"MitRejsekort" App' }
    if($agent -match 'Rejs%20Nemt') { $agent = '"Rejs Nemt" App' }
    if($agent -match 'Rejsekort/2015') { $agent = '"Rejsekort(??)" App' }
    if($agent -match 'Mozilla\/5.0\+\(Windows\+NT\+[0-9]+.[0-9]+;\+WOW64;\+Trident\/7\.0;\+rv:11.0\)\+like\+Gecko') { $agent = 'Internet Explorer' }

    "$os / $agent"
}} -AutoSize










$csvApp = foreach($file in '\\rejk-p-app004\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app003\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app002\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app001\d-drive\Logfiles\W3SVC3\u_ex161229.log') {
    Write-Progress -Activity 'Csv APP' -Status "File: $($file)" -id 1 
    $stream = New-Object System.IO.StreamReader -ArgumentList $file

    while($line = $stream.ReadLine()) {
        Write-Progress -Activity 'Readline' -Status "Position $($stream.BaseStream.Position) / $($stream.BaseStream.Length)" -PercentComplete (100 / $stream.BaseStream.Length * $stream.BaseStream.Position) -parentid 1 -id 2
            
        if($line.StartsWith('#')) { continue }

        $c =  $line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
        <#if([int]$c.'time-taken' -gt 5000) { 
            $c
        }#>

        $c
    }
    
    $stream.Close()

}

$csvApp | foreach { $datetime = "$($_.date) $($_.time)"; $datetime = Get-Date $datetime; $datetime = $datetime.AddHours(1); $_ | Add-Member -MemberType NoteProperty -Name DateTime -Value $datetime.ToString('yyyy-MM-dd HH:mm:ss') }

$csvApp | sort datetime | ft 's-computername', 'time-taken', datetime, 'cs-method', 'cs-uri-query', @{ N='Agent'; E={ 
    $os = $agent = $_.'cs(User-Agent)'

    if($os -match 'Windows') { $os = 'Windows' }
    if($os -match 'iPhone|Darwin') { $os = 'iPhone' }
    if($os -match 'iPad') { $os = 'iPad' }
    if($os -match 'Dalvik|Android') { $os = 'Android' }
    if($os -match 'Mac\+OS\+X') { $os = 'Mac' }
    if($os -match 'Ubuntu') { $os = 'Ubuntu' }
    if($os -match 'Linux') { $os = 'Linux' }

    
    if($agent -match 'chrome') { $agent = 'Chrome' }
    if($agent -match 'Firefox') { $agent = 'Firefox' }
    if($agent -match 'Safari') { $agent = 'Safari' }
    if($agent -match 'Mit%20Rejsekort') { $agent = '"MitRejsekort" App' }
    if($agent -match 'Rejs%20Nemt') { $agent = '"Rejs Nemt" App' }
    if($agent -match 'Rejsekort/2015') { $agent = '"Rejsekort(??)" App' }
    if($agent -match 'Mozilla\/5.0\+\(Windows\+NT\+[0-9]+.[0-9]+;\+WOW64;\+Trident\/7\.0;\+rv:11.0\)\+like\+Gecko') { $agent = 'Internet Explorer' }

    "$os / $agent"
}} -AutoSize