Powershell with Get-MessageTrackingLog (Exchange 2007)

I wonder if you can help me. I am trying to extract a list of recipients that have sent emails to themselves (from domain1 to domain2) using get-messagetrackinglog tool within Exchange. My little script seems to work fine with the sender's part, however after a few days of pondering I am unable to make it work with recipients. I suspect that this is because there can be many recipients (as opposed to only one sender) for each email and this requires an array to be assigned to the recipients variable however being new to powershell I am not entirely sure how to do it and how to pipe it through. The logic is the following:

a) I want to use split command to segregate all senders (using space delimiter) and fetch them into an array, b) then to detach both sender's and recipients' first parts of addresses from domains using @ delimiter and c) compare their first part of email addresses that I've got (values returned from adam@domain1 and adam@domain2). d) If they match - I need email message results to be exported to .csv.

I have got this far:

Get-MessageTrackingLog -server "pdnaex1" -EventID "SEND" -start "01/10/2010 00:00:00" -end "31/10/2010 23:59:59" -resultsize Unlimited | Where {[string]$.sender.split("@")[0] -like [string]$.recipients.split("@")[0]} | Select timestamp,@{Name="Sender";Expression={$.sender}},@{Name="Recipients";Expression={$.recipients}},messagesubject | export-csv X:\XXX.csv

I know above is incorrect but hope I make my question clear.

Any help is greatly appreciated. I suspect my script fails because I fail to populate an array of recipients 开发者_运维问答and compare sender's value against each entry within that array but I cant work out how to do that.

You can use -like to compare an array to a scalar, but you cannot use it to compare a scalar to an array. The array argument has to come first.

PS C:> $a = "a","b","c"

PS C:> $b = "b"

PS C:> $a -like $b

b

PS C:> $b -like $a

False

You can get an arry by casting $_.recipients as [string] and splitting it on the @, but you can't select just the user part from that array easily.

Additionally, you need to reference the senders and recipients as $.sender and $.recipients, rather than $sender and $recipients.

Partially tested:

Get-MessageTrackingLog -server "pdnaex1" -EventID "SEND" -start "01/10/2010 00:00:00" -end "31/10/2010 23:59:59" -resultsize Unlimited | Where {($.recipients |% {$.split("@")[0]}) -like $_.sender.split("@")[0]} | Select timestamp,@{Name="Sender";Expression={$.sender}},@{Name="Recipients";Expression={$.recipients}},messagesubject | export-csv X:\XXX.csv

Note: the underscores after the $ don't seem to be showing up in the post in the answer.