Get-WinEvent -FilterHashTable "logname" is Case Sensitve

This topic contains 2 replies, has 2 voices, and was last updated by  Dan Foxley 4 years ago.

  • Author
  • #11281

    Dan Foxley

    With Powershell 3.0 in ISE remoting to a Windows Server 2008 R2, running:

    Get-WinEvent -FilterHashTable @{logname='application';ID=1316}

    Returns w/o issue.


    Get-WinEvent -FilterHashTable @{LogName='application';ID=1316}

    Returns the following error:

    You must specify at least one Log, Provider or Path key-value pair.
    + CategoryInfo :
    + FullyQualifiedErrorId : LogProviderOrPathNeeded,Microsoft.PowerShell.Commands.GetWinEventCommand

    The Get-WinEvent help shows "LogName" being used.

  • #11282

    Don Jones

    So, the only difference being the case, you're saying? PowerShell's generally case-insensitive, but anytime you use a -Filter, the shell is just handing off to the underlying technology, which might be case-sensitive.

    FWIW, both commands run without error on my Win2012R2 system, so it's possible 2008R2 was case-sensitive. The PowerShell v3 docs would likely have been written from Win2012 behavior.

  • #11285

    Dan Foxley

    Correct, that is the only difference, the case. I guess it was half frustration, the error didn't sync with the issue and it took me an hour or so to sort this out.


You must be logged in to reply to this topic.