Get-WinEvent -FilterHashTable with multiple IDs in a variable not working

Question

This work for me:

Get-WinEvent -FilterHashTable @{Logname = "ForwardedEvents" ; ID = 4625,4740}

(.... results I expect...)

This works:

$EventId = "4625"

Get-WinEvent -FilterHashTable @{Logname = "ForwardedEvents" ; ID = $EventId}

This doesn't work:

$EventId = "4625,4740"

Get-WinEvent -FilterHashTable @{Logname = "ForwardedEvents" ; ID = $EventId}

Error...

  Get-WinEvent : No events were found that match the specified selection criteria.
At line:1 char:13
+ Get-WinEvent <<<<  -FilterHashTable @{Logname = "ForwardedEvents" ; ID = $EventIds}
+ CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
+ FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand

Can anyone help please?

Mike Q · Accepted Answer · 2022-08-23 19:23:50Z

7

Just change it to $EventId = 4625,4740 (remove the quotes) and that should work. Looking at the documentation for Get-WinEvent and the -FilterHashTable we see:

-- ID=<Int32[]>

So it is expecting an array and not a string.

edited Aug 23, 2022 at 19:23

Mike Q

7,4955 gold badges62 silver badges69 bronze badges

answered Mar 7, 2016 at 12:54

Matt

47k9 gold badges90 silver badges125 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

adriansroaming Over a year ago

Thanks Matt. Works great.

Collectives™ on Stack Overflow

Get-WinEvent -FilterHashTable with multiple IDs in a variable not working

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related