Search evidence as literal text
Find an exact text marker and preserve line numbers without executing or rewriting evidence.
Text is data
Logs can contain commands, quotes, and strings that resemble code. Read them as text. Never dot-source a log or pass its contents to Invoke-Expression to make parsing easier. That would change the operation from reading evidence to executing it.
This task looks for the literal marker [ALERT]. Select-String uses regular expressions by default. In a regex, brackets create a character class, so [ALERT] means a single character from that set, not the complete marker. -SimpleMatch makes the pattern literal.
Keep the location of the match
A MatchInfo object includes LineNumber and the original Line. Preserve both so a reviewer can locate and interpret the surrounding text. Line numbers are one-based: the first line is 1.
Select-String -LiteralPath '/home/user/application.log' -Pattern 'Startup' -SimpleMatch
Literal matching is still substring matching. It is appropriate for finding this marker anywhere on a line. It would not replace the exact domain-field comparison from the indicators lesson. Choose the operation that matches your question.
PowerShell's search is case-insensitive by default. This task follows that default and supplies consistently cased markers. If a source format requires case-sensitive markers, state that requirement and add -CaseSensitive.
Go deeper
Get-Content -LiteralPath '/home/user/application.log' | Select-Object -First 3
Put it into practice.
Find lines containing the literal marker [ALERT] in application.log. Emit LineNumber and the unchanged Line for each match, in file order. Use the default case-insensitive text matching. Do not execute or edit the log.
See an explained solution
Select-String -LiteralPath '/home/user/application.log' -Pattern '[ALERT]' -SimpleMatch | Select-Object LineNumber, Line
SimpleMatch prevents the brackets from becoming regex syntax. The original line text and its line number remain available as structured properties.