LucD
Leadership
Leadership

I'm not sure how you calculate $duration.

Also, you have to escape special characters in a RegEx.
This seems to work for me (tested with the sample vmware.log extract you posted).

Get-Content -Path .\vmware.log |
where {$_ -match 'VMX has left the building|VMX exit \(0\).|Transitioned vmx/execState/val to poweredOff' } |
ForEach-Object -Process {
    $date,$dummy,$text = $_.Split('|')
    New-Object -TypeName PSObject -Property @{
        Date = [DateTime]$date
        Duration = '?'
    }
}


Blog: lucd.info  Twitter: @LucD22  Co-author PowerCLI Reference