I'm not sure how you calculate $duration.
Also, you have to escape special characters in a RegEx.
This seems to work for me (tested with the sample vmware.log extract you posted).
Get-Content -Path .\vmware.log |
where {$_ -match 'VMX has left the building|VMX exit \(0\).|Transitioned vmx/execState/val to poweredOff' } |
ForEach-Object -Process {
$date,$dummy,$text = $_.Split('|')
New-Object -TypeName PSObject -Property @{
Date = [DateTime]$date
Duration = '?'
}
}
Blog: lucd.info Twitter: @LucD22 Co-author PowerCLI Reference