Filtering PowerShell Objects with Where-Object
The output of any PowerShell cmdlet is returned as objects. The Where-Object cmdlet is used in PowerShell to filter such objects. The Where-Object cmdlet allows filtering the output of the previous command using a pipeline.
In this article, we’ll show how to use the Where-Object cmdlet in PowerShell.
Using Where-Object
For example, if we need to list the services running on the computer using the Get-Service cmdlet. To list only Windows services with a Running status, use the following command with Where-Object filter:
Get-Service | Where-Object Status -eq “Running”
Display all available cmdlet properties that can be used as a Where-Object filter using the command:
Get-Service | Get-Member -MemberType *Property*
Aliases
There are two aliases for the Where-Object cmdlet — Where and the “?” character.
The following two PowerShell commands are the same as the first command:
Get-Service | Where Status -eq “Running”
Get-Service | ? Status -eq “Running”
Filter conditions
You may use different and multiple filter conditions in the Where-Object cmdlet.
For example, we need to find all running services that contain the words Remote or Policy in DisplayName:
Get-Service | Where-Object {$_.Status -eq ‘Running’ -and $_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’}
The number of conditions for filtering objects will be unlimited. If you need to use complex logic in a filter, limit the conditions with parentheses:
Get-Service | Where-Object {($_.Status -eq ‘Running’) -and ($_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’)}
Compare the results of the last two commands.
You can use different condition operators in the Where-Object cmdlet (the names of case-sensitive operators are shown in parentheses):
EQ (CEQ) — value is equal;
NE (CNE) — not equal;
GT (CGT) — the value is greater than;
LT (CLT) — less than;
LE (CLE) — less than or equal to;
GE (CGE) — more or equal;
Contains (CContains) — string entry;
NotContains (CNotContains) – occurrence in property;
Match (CMatch) — regular expression mask search;
not match (CNotMatch) — no match by mask in regular expression;
Like (CLike) — filter by mask;
IS, IsNot — commonly used to check data types ($array | where {$_ -IsNot [int]}).
For example, the following command will list running processes that use more than 50MB of RAM, and sort them in descending order:
Get-Process | ? {$_.WorkingSet -GT 50000*1024}|select processname,@{l=”Working Memory (MB)”; e={$_.workingset / 1mb}} |sort “Working Memory (MB)” -Descending
The Where-Object cmdlet is a powerful PowerShell filtering tool that comes in handy when you need to select objects with certain special from the returned objects.
