linked ton onescancsv.ps1 add Only events that occured after the last memorized event

onescan_csv_incremental.ps1

get-eventlog -LogName "Key Management Service" -ComputerName "COMPUTER" -InstanceId 1073754114  -After $([datetime]::ParseExact( $(import-csv .\Leases.csv |? { $_.ServerName -eq "COMPUTER" }| select TimeGenerated | sort TimeGenerated -desc | select -First 1).TimeGenerated ,'MM/dd/yyyy HH:mm:ss', $null) ) | select Index,Message,TimeGenerated |% {if ($_.MEssage -match ".*(0x[0-9a-f]+),(\d+),([^,]+),([0-9a-f\-]+),([^,]+),(\d),(\d),(\d+),([0-9a-f\-]+).*") { $_ | Add-Member -type NoteProperty -name Client -Value $matches[3] -Passthru | Add-Member -type NoteProperty -name CMID -Value $matches[4] -PassThru | Add-Member -type NoteProperty -name ErrorLevel -Value $matches[1] -PassThru| Add-Member -type NoteProperty -name MinCount -Value $matches[2] -PassThru| Add-Member -type NoteProperty -name DateDemand -Value $matches[5] -PassThru | Add-Member -type NoteProperty -name isVM -Value $matches[6] -PassThru| Add-Member -type NoteProperty -name State -Value $matches[7] -PassThru | Add-Member -type NoteProperty -name TTLmin -Value $matches[8] -PassThru | Add-Member -type NoteProperty -name LicenseId -Value $matches[9] -PassThru} } | select @{N="Id";E={$_.Index}},Client,CMID,ErrorLevel,MinCount,TimeGenerated,DateDemand,isVM,State,TTLmin,LicenseId |% {"$("$(@{$true=$(Import-Csv ./Leases.csv | measure-object LeaseID -Max).Maximum;$false=0}[$(Import-Csv Leases.csv | measure-object LeaseID  -Max).Maximum -ne $null ]+ 1)"),$($CMID = $_.CMID;$(if( @(Import-Csv ./Computer.csv |? { $_.CMID -eq $CMID}).Count -gt 0 ){"$($(Import-Csv ./Computer.csv |? { $_.CMID -eq $CMID}).ComputerId)"}else{"$(@{$true=$(Import-Csv ./Computer.csv | measure-object ComputerId -Max).Maximum;$false=0}[$(Import-Csv Computer.csv | measure-object ComputerId  -Max).Maximum -ne $null ]+ 1),$($_.Client),$($_.CMID),$($_.IsVM)">> "./Computer.csv"  ; "$($(Import-Csv Computer.csv | measure-object ComputerId  -Max).Maximum)"})),$($LID = $_.LicenseID;$(if( @(Import-Csv ./Licence.csv |? { $_.LicenseId -eq $LID}).Count -gt 0 ){"$($(Import-Csv ./Licence.csv |? { $_.LicenseID -eq $LID}).LicenseRow)"}else{"$(@{$true=$(Import-Csv ./Licence.csv | measure-object LicenseRow -Max).Maximum;$false=0}[$(Import-Csv Licence.csv | measure-object LicenseRow  -Max).Maximum -ne $null ]+ 1),$($_.LicenseId),$($_.MinCount)" >> Licence.csv; "$($(Import-Csv Licence.csv | measure-object LicenseRow  -Max).Maximum)" })),$($_.TimeGenerated),$($_.DateDemand),$($_.TTLMin),$($_.State),COMPUTER" >> Leases.csv}