One of the great features of PowerShell is its ability to sort and filter objects. This filtering can be used to limit a larger result set and reporting only the information necessary.
This section will review several methods of filtering and sorting data.
To explore the filtering capabilities of PowerShell, we look at the running processes on our computer. We then use the
Whereclause to filter the results.Get-Process | Where-Object {$_.Name -eq "chrome"} Get-Process | Where-Object Name -eq "chrome" Get-Process | Where-Object Name -like "*hrom*" Get-Process | Where-Object Name -ne "chrome" Get-Process | Where-Object Handles -gt 1000To view sorting in PowerShell, we again view the processes on our computer and use
Sort-Objectto change the default sort order.Get-Process | Sort-Object Handles Get-Process | Sort-Object Handles -Descending Get-Process | Sort-Object Handles, ID –Descending
To explore the select features of PowerShell, we use
Select-StringandSelect-Objectclause:Select-String -Path C:\Windows\WindowsUpdate.log -Pattern "Installing updates" Get-Process | Select-Object Name -Unique
To view the grouping capabilities of PowerShell, we use
Format-Tablewith the–GroupBycommand:Get-Process | Format-Table -GroupBy ProcessName
In the first section, we review various methods of filtering information using the Where clause:
The first method uses the PowerShell
Where-Objectclause format. The$_identifier represents the object being passed through the pipe, so$_.Namerefers to theNameproperty of the object. The–eqis an equals parameter that instructsWhere-Objectto compare the two values.The second method performs the same task as the first but uses a parameter format that is new in PowerShell 3.0. In this method the
Where-Objectcomparison no longer needs to use$_to reference the object being passed, and we no longer need the curly braces{}.The last three methods perform similar comparisons using different parameter. The
–likeparameter allows for the use of the wildcard character*allowing for less exact filtering. The–neparameter means not equal and is the exact opposite of the equals parameter. And the–gtparameter means greater than and compares the attribute value to a known value.
The second section uses the Sort-Object command to sort and organize the object attributes. In this section, we show sorting by the handles attribute in both ascending (the default method), and descending format. Additionally, we see that multiple attributes can be sorted at the same time.
The third section uses the Select-String and Select-Object commands to restrict what is returned. The first method searches the WindowsUpdate.log for the string Installing updates and returns the results. The second method takes the output of Get-Process and filters it to only return a unique list of named processes.
The fourth section shows how to perform grouping based on an attribute. The Format-Table command includes a property named –GroupBy that, instead of returning a single table, will return multiple tables. In this case, for each unique ProcessName, a separate table is returned.