Don Jones’ Favorite PowerShell Cmdlets, Part 3 of 10: Where-Object
Get-Process. Get-Service. Heck, especially Get-EventLog. What do they all have in common? They tend to return too much information. Fortunately, they’re not just displaying plain text, they’re displaying objects, so all we need to do is filter those objects a bit, using Where-Object. Pipe in some objects and specify a criteria, and Where-Object removes all the objects that don’t meet your criteria:
Get-WMIObject Win32_Service | Where { $_.StartMode -eq “Auto” }
“Where” is an alias to Where-Object, and it’s a lot easier to type - and I think it makes the command easier to read, too. $_, used in the criteria, represents “those objects that were piped in.” $_.StartMode, then, refers to “the StartMode property of those objects that were piped in.” Pipe objects to Get-Member (its alias is gm) to see their properties:
Get-WMIObject Win32_Service | gm
I use this with event log entries all the time, to search for a specific event ID:
Click past the fold for more…
Get-EventLog System -newest 100 | Where { $_.EventID -eq 1071 }
And so forth - very convenient. Where-Object is one of the core PowerShell cmdlets, so you can use it with Exchange Server 2007, System Center Virtual Machine Manager, and anything else “built on” PowerShell. Imagine getting all mailboxes, and filtering for just those over a certain size… you could then pipe those large mailboxes to Move-Mailbox, moving them off to a new, larger mailbox server. Cool stuff - and an amazing one-line command!
Don Jones is the Lead Scripting Guru for SAPIEN Technologies and a Windows PowerShell MVP. He’s the co-author of Windows PowerShell: TFM, 2nd Edition and is the Windows PowerShell columnist for TechNet Magazine. Don is also the Director for the new centralized, independent PowerShell online community: www.PowerShellCommunity.org.
Get your hands on the full Don Jones Favorite Cmdlets Series at this address:
http://www.realtime-windowsserver.com/type/mt-search.cgi?tag=don%20jones%20favorite%20cmdlets&blog_id=1
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine