Powershell: regex on Get-EventLog output and find largest number - regex

Question

I need to pull a particular number from the output of this command:
Get-EventLog "application" | Where-Object {$_.EventID -eq 6006}
Sample output is:
Index Time EntryType Source InstanceID Message
----- ---- --------- ------ ---------- -------
18297 May 15 18:49 Warning Wlclntfy 2147489654 The winlogon notification subscriber <Profiles> took 60 second(s) to handle the notification event (Logon).
11788 Jan 31 08:11 Warning Wlclntfy 2147489654 The winlogon notification subscriber <Profiles> took 68 second(s) to handle the notification event (Logon).
5794 Oct 16 09:41 Warning Wlclntfy 2147489654 The winlogon notification subscriber <Sens> took 225 second(s) to handle the notification event (Logoff).
5596 Oct 11 08:03 Warning Wlclntfy 2147489654 The winlogon notification subscriber <Profiles> took 69 second(s) to handle the notification event (Logon).
2719 Aug 30 07:50 Warning Wlclntfy 2147489654 The winlogon notification subscriber <Profiles> took 65 second(s) to handle the notification event (Logon).
What I actually need to do is pull the number of seconds reported by the <Profiles> events, and pull out the largest one. I've gotten as far as figuring out (?<=<Profiles> took )(\d+) will work to pull just the numbers I need, but I'm not sure how to proceed to actually extract them. I've tried piping it to Select-String -pattern, but that just returns nothing at all.

Answer 1

You want the $matches builtin variable. $matches[0] is the text that matched the regexp, and $matches[1] .. $matches[n] are the matched parenthetical expressions (if there were any).
Sadly I don't have any EventID=6006 on my machine so I'm doing this without testing, but this should select the last item from the sorted list of seconds:
Get-EventLog "application" |
Where-Object {$_.EventID -eq 6006} |
Where-Object { $_.Message -match "<Profiles> took (\d*) second" } |
foreach { [int]$matches[1] } |
sort |
select -last 1

Answer 2

You can get the value(s) without regex. Take a look at the ReplacementStrings property of the event. It contains an array that holds the replacement strings stored in the event entry.
PS> $event.ReplacementStrings
Profiles
71
Logon
Based on that you could use array indexing to get the values you're after.
Get-EventLog application |
Where-Object {$_.EventID -eq 6006 -and $_.ReplacementStrings -eq 'Profiles'} |
Foreach-Object { $_.ReplacementStrings[1] }