Filtering the Output with the Where-Object Command

There are times when you don't want to see all the data, but instead you wish to see only a subset of the data that meets a certain condition. You could use the Where-Object command (which has an alias of Where) to filter the result.

In the following code, the Where clause is used to retrieve a list of only the logs that have a Max(K) value greater than 15168. Notice the use of $_. The fi rst command, Get- EventLog, creates a collection of event logs that is then piped to the Where clause. The $_ refers to this collection, and a period can then be added to reference any of the properties of the objects in the collection.

Notice that the entire condition is enclosed in braces ({ }).

Similarly, here's a method you can use to list only services that start with the letter S using the -like operator. Notice that the asterisk (*) is used as the wildcard, and the string you're searching for must be in double quotes: