Filtering PowerShell Objects with Where-Object

The output of any PowerShell cmdlet is returns as objects. The Where-Object cmdlet is used in PowerShell to filter such objects. The Where-Object cmdlet allows you to filter the output of the previous command using a pipeline. In this article, we’ll show how to use the Where-Object cmdlet in PowerShell.

Let’s take a look at a simple example of using Where-Object. For example, we need to list the services running on the computer using the Get-Service cmdlet. To list only Windows services with a Running status, use the following command with Where-Object filter:

Get-Service | Where-Object Status -eq "Running"

powershell where filter

You can display all available cmdlet properties that can be used as a Where-Object filter using the command:

Get-Service | Get-Member -MemberType *Property*

powershell where object

There are two aliases for the Where-Object cmdlet — Where and the “?” character. The following two PowerShell commands are the same as the first command:

Get-Service | Where Status -eq "Running"

Get-Service | ? Status -eq "Running"

You can use multiple filter conditions in the Where-Object cmdlet. For example, we need to find all running services that contain the words Remote or Policy in DisplayName:

Get-Service | Where-Object {$_.Status -eq 'Running' -and $_.DisplayName -like 'Remote' -or $_.DisplayName -like '*Policy*'}

The number of conditions for filtering objects can be unlimited. If you need to use complex logic in a filter, limit the conditions with parentheses:

Get-Service | Where-Object {($_.Status -eq 'Running') -and ($_.DisplayName -like 'Remote' -or $_.DisplayName -like '*Policy*')}

Compare the results of the last two commands.

READ ALSO  How to Use ForEach Loop in PowerShell?

powershell where object filter

You can use different condition operators in the Where-Object cmdlet (the names of case-sensitive operators are shown in parentheses):

  • EQ (CEQ) — value is equal;
  • NE (CNE) — not equal;
  • GT (CGT) — the value is greater than;
  • LT (CLT) — less than;
  • LE (CLE) — less than or equal to;
  • GE (CGE) — more or equal;
  • Contains (CContains) — string entry;
  • NotContains (CNotContains) – occurrence in property;
  • Match (CMatch) — regular expression mask search;
  • NotMatch (CNotMatch) — no match by mask in regular expression;
  • Like (CLike) — filter by mask;
  • IS, IsNot — commonly used to check data types ($array | where {$_ -IsNot [int]}).

For example, the following command will list running processes that use more than 50MB of RAM, and sort them in a descending order:

Get-Process | ? {$_.WorkingSet -GT 50000*1024}|select processname,@{l="Working Memory (MB)"; e={$_.workingset / 1mb}} |sort "Working Memory (MB)" -Descending

where object filter in powershell

The Where-Object cmdlet is a powerful PowerShell filtering tool that comes handy when you need to select objects that match certain criteria from the returned objects.

Cyril Kardashevsky

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.