Get-WinEvent -FilterHashTable "logname" is Case Sensitve

This topic contains 2 replies, has 2 voices, and was last updated by Profile photo of Dan Foxley Dan Foxley 3 years, 5 months ago.

  • Author
    Posts
  • #11281
    Profile photo of Dan Foxley
    Dan Foxley
    Participant

    With Powershell 3.0 in ISE remoting to a Windows Server 2008 R2, running:

    Get-WinEvent -FilterHashTable @{logname='application';ID=1316}

    Returns w/o issue.

    Running:

    Get-WinEvent -FilterHashTable @{LogName='application';ID=1316}

    Returns the following error:

    You must specify at least one Log, Provider or Path key-value pair.
    + CategoryInfo :
    + FullyQualifiedErrorId : LogProviderOrPathNeeded,Microsoft.PowerShell.Commands.GetWinEventCommand

    The Get-WinEvent help shows "LogName" being used.

  • #11282
    Profile photo of Don Jones
    Don Jones
    Keymaster

    So, the only difference being the case, you're saying? PowerShell's generally case-insensitive, but anytime you use a -Filter, the shell is just handing off to the underlying technology, which might be case-sensitive.

    FWIW, both commands run without error on my Win2012R2 system, so it's possible 2008R2 was case-sensitive. The PowerShell v3 docs would likely have been written from Win2012 behavior.

  • #11285
    Profile photo of Dan Foxley
    Dan Foxley
    Participant

    Correct, that is the only difference, the case. I guess it was half frustration, the error didn't sync with the issue and it took me an hour or so to sort this out.

    Thanks,
    Dan

You must be logged in to reply to this topic.