Mark Minasi's Reader Forum
Mark Minasi's Reader Forum
Home | Profile | Register | Active Topics | Active Polls | Members | Search | FAQ | Minasi Forum RSS Feed
Username:
 Password:
Save Password
Forgot your Password?

 All Forums
 HALP! Questions on Windows and Windows Server
 PowerShell
 -or operator		  New Topic  Reply to Topic
 Printer Friendly
Author Previous Topic Topic Next Topic  

aval
Honorable But Hopeless Addict

USA
3276 Posts
Status: offline
Posted - 05/29/2012 :  9:57:29 PM  Show Profile  Reply with Quote
PS C:\> get-winevent | select -first 100 | where {$_.id -eq "400" -or "600"}

This does not work - which I suspected. You can't just throw the -or operator in there after -eq.

But these do not work either:

PS C:\> get-process | ? {$_.ProcessName -eq ("winlogon" -or "svchost")}
*
*
*
PS C:\> get-process | ? {$_.ProcessName -eq "winlogon"} -or {$_.ProcessName -eq "svchost"}

How would I search for "either or"?

This was orginally for finding events in the Event Viewer logs with EventID 100, 200, 300 and 400 (just example numbers). I was not able to make that work so I tried something more simple - or so I thought: finding process with either winlogon or svchost for the process name.

Jazzy
Administrator

Netherlands
1932 Posts
Status: offline
Posted - 05/30/2012 :  02:37:53 AM  Show Profile  Visit Jazzy's Homepage  Click to see Jazzy's MSN Messenger address  Reply with Quote
I think you should use the -or operator like this:

PS C:\> get-winevent | select -first 100 | where {$_.id -eq "400" -or $_.id -eq "600"}
Jetze Mellema

Exchange specialist
Former MVP (2005-2012)
My blog: http://jetzemellema.blogspot.com (Dutch)
My company: http://www.imara-ict.nl/
Edited by - Jazzy on 05/30/2012 02:38:12 AM
Go to Top of Page

Xenophane
Honorable But Hopeless Addict

Denmark
3070 Posts
Status: offline
Posted - 05/30/2012 :  08:17:39 AM  Show Profile  Visit Xenophane's Homepage  Send Xenophane an ICQ Message  Reply with Quote
As Jetze states, the "-or" operator validates an entire statement.

So when you try to do :

PS C:\> get-winevent | select -first 100 | where {$_.id -eq "400" -or "600"}

It does not know what to compare 600 against, so basically you are asking: is the "id" property of the object equal to 400?, or is ??? 600.

You could also do something like:
PS C:\> get-winevent | select -first 100 | where {$_.id -eq "400" -or $_.name -eq "Error"}

Here you compare 2 different properties..

So basically you always have to tell it, which property you are looking at.
Microsoft Powershell MVP

SIG> George Bernard Shaw : The power of accurate observation is commonly called cynicism by those who have not got it. </SIG>

You can read my blog at www.xipher.dk
Go to Top of Page

jhicks
Here To Stay

USA
283 Posts
Status: offline
Posted - 05/30/2012 :  10:13:00 AM  Show Profile  Visit jhicks's Homepage  Reply with Quote
Sometimes you don't even need the -Or operator. Many cmdlets allow you to do some type of filtering by specifying an array of values:L

get-process lsass,svchost

Or you can take advantage of specific filter parameters:

$q=@"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[(EventID=7036 or EventID=7035)]]</Select>
</Query>
</QueryList>
"@

get-winevent -MaxEvents 10 -FilterXml $q
Jeffery Hicks
Windows PowerShell MVP

http://jdhitsolutions.com.blog
http://twitter.com/JeffHicks
http://www.ScriptingGeek.com
Now Available: Managing Active Directory with Windows PowerShell: TFM 2nd ed.
Go to Top of Page
  Previous Topic Topic Next Topic  
 New Topic  Reply to Topic
 Printer Friendly
Jump To:
Mark Minasi's Reader Forum © 2002-2011 Mark Minasi Go To Top Of Page
This page was generated in 0.09 seconds. Snitz Forums 2000