How to filter the output from the output of this powershell command?

Question

Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-PrintService/Operational";} |
Format-Table -Property TimeCreated,
                        @{label='UserName';expression={$_.properties[2].value}},
                        @{label='ComputerName';expression={$_.properties[3].value}},
                        @{label='PrinterName';expression={$_.properties[4].value}},
                        @{label='PrintSize';expression={$_.properties[6].value}},
                        @{label='Pages';expression={$_.properties[7].value}}

I want to filter out all those lines where PrinterName is "MyPrinter" from the output of the above command

Martin Brandl · Accepted Answer · 2019-11-12 11:37:06Z

3

Just add a Where-Object condition before you format the table:

Get-WinEvent -FilterHashTable @{LogName="Security";} | 
    Where-Object { $_.properties[4].value -eq 'MyPrinter'} | 
    Format-Table -Property TimeCreated,
        @{label='UserName';expression={$_.properties[2].value}},
        @{label='ComputerName';expression={$_.properties[3].value}},
        @{label='PrinterName';expression={$_.properties[4].value}},
        @{label='PrintSize';expression={$_.properties[6].value}},
        @{label='Pages';expression={$_.properties[7].value}}

answered Nov 12, 2019 at 11:37

Martin Brandl

59.4k16 gold badges151 silver badges190 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

AdminOfThings Over a year ago

I think you want $_.properties[4].value -ne 'MyPrinter'

Martin Brandl Over a year ago

@AdminOfThings You might be right. munish just adopt the operator to your need.

Collectives™ on Stack Overflow

How to filter the output from the output of this powershell command?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related