Windows 7 / Getting Started

---

Collections

A collection is a type of an array used to hold information on objects.

Imagine that you have a bucket, and you've placed 10 marbles in the bucket. These marbles are objects and very likely they are different. Some may be clear and others cloudy, some steel and others glass, some small and others large. You get the idea. Each of these marbles has specific properties that can be used to describe it.

Now if you created a spreadsheet, you could list each of the marbles and their associated properties. Later, if you wanted information on a specific marble, you could access the spreadsheet and retrieve the information. In this context, the data in the spreadsheet is the collection that represents the actual objects.

Similarly, with PowerShell you can create a collection of information on objects. You can then use code to loop through the collection.

As an example, consider this code:

$colLog = get-EventLog -list

The Get-EventLog -list will list information on the EventLogs on a system in five columns: Max(K), Retain, OverflowAction, Entries, and Log. The $colLog = will store the result of the command in the variable named $colLog. While the get-EventLog command will retrieve many logs, imagine there are only five. The collection would look like Table below.

A Collection of Logs

Max(K)	Retain	OverFlowAction	Entries	Log
20,480	0	OverwriteAsNeeded	46,266	Application
20,480	0	OverwriteAsNeeded	53,635	System
20,480	7	OverwriteOlder	2,345	Security
15,360	0	OverwriteAsNeeded	1,206	Session
15,360	0	OverwriteAsNeeded	453	Windows PowerShell

Data stored in the collection can be accessed and retrieved, and it is commonly done so using a ForEach command. As an example, the following script will store the data in a collection and then loop through the collection to retrieve it:

$colLog = get-EventLog -list
ForEach ($Item in $colLog) {
Write-0utput $Item
}

This is actually no different than just executing the Get-EventLog -List command. However, the real strength of the collection is that you can manipulate it. If you were interested in only some of the columns, you could pick and choose what is displayed.

Imagine that all you really want to know is the log name and its size. These two columns have headers of Log and Max(K) (though Max(K) is identified as MaximumKilobytes). Each item in the collection can be identified using these names. Because the script uses $Item as the variable name to hold the collection, the columns would be identified as $Item.Property. In other words, $Item.Log retrieves the log name and $Item.

MaximumKilobytes retrieves the Max(K) value.
$colLog = get-EventLog -list
ForEach ($Item in $ColLog) {
Write-Output $Item.Log, $Item.MaximumKilobytes
}

However, this is pretty messy. Instead of outputting the data as a table, it sends each item on a single line. You'll see later in the tutorial how this can be cleaned up using the -f formatting switch.