Get-WinEvent -FilterHashTable "logname" is Case Sensitve

This topic contains 3 replies, has 3 voices, and was last updated by  jonathan barrow 2 months, 1 week ago.

  • Author
    Posts
  • #11281

    Dan Foxley
    Participant

    With Powershell 3.0 in ISE remoting to a Windows Server 2008 R2, running:

    Get-WinEvent -FilterHashTable @{logname='application';ID=1316}

    Returns w/o issue.

    Running:

    Get-WinEvent -FilterHashTable @{LogName='application';ID=1316}

    Returns the following error:

    You must specify at least one Log, Provider or Path key-value pair.
    + CategoryInfo :
    + FullyQualifiedErrorId : LogProviderOrPathNeeded,Microsoft.PowerShell.Commands.GetWinEventCommand

    The Get-WinEvent help shows "LogName" being used.

  • #11282

    Don Jones
    Keymaster

    So, the only difference being the case, you're saying? PowerShell's generally case-insensitive, but anytime you use a -Filter, the shell is just handing off to the underlying technology, which might be case-sensitive.

    FWIW, both commands run without error on my Win2012R2 system, so it's possible 2008R2 was case-sensitive. The PowerShell v3 docs would likely have been written from Win2012 behavior.

  • #11285

    Dan Foxley
    Participant

    Correct, that is the only difference, the case. I guess it was half frustration, the error didn't sync with the issue and it took me an hour or so to sort this out.

    Thanks,
    Dan

  • #89246

    jonathan barrow
    Participant

    I just ran into this exact same issue. Code I had written that used "LogName" which worked fine on some boxes failed when I attempted to run them remotely using InvokeCommand with the same error the OP mentioned. When I changed my code to read "logname" (all lowercase) it functioned as expected.

You must be logged in to reply to this topic.