How do I select only the Log and # Entries from Get-EventLog -List?

This topic contains 3 replies, has 2 voices, and was last updated by  Mark Stepan 2 years, 2 months ago.

  • Author
  • #37023

    Mark Stepan

    When I run Get-EventLog -List, I get 5 columns in the result. I only want 2 of them (Log and Entries). This sounds simple, but I can't seem to get it to work. When I pipe it to Select-Object (Get-EventLog -List | Select-Object Log, Entries), I get something different in the entries column.

    Thanks in advance ...

  • #37024

    Dave Wyatt

    That's PowerShell being a little too helpful. 🙂 The default columns you see from the formatting system don't match up with the actual properties on the object. The Entries property is actually a collection, but the default view for those EventLog object is showing you an entry count instead. This works:

    Get-EventLog -List | Select-Object @{ Name='Entries'; Expression = { $_.Entries.Count }}, Log
  • #37025

    Dave Wyatt

    You can get information about what PowerShell's showing you by default with the Get-FormatData cmdlet, incidentally:

    $formatData = Get-FormatData -TypeName System.Diagnostics.EventLog
    Label          Alignment Width
    -----          --------- -----
    Max(K)             Right     8
    Retain             Right     6
    OverflowAction Undefined    18
    Entries            Right    10
    Log            Undefined     0
    Alignment DisplayEntry
    --------- ------------
    Undefined $_.MaximumKilobytes.ToString('N0')
    Undefined MinimumRetentionDays
    Undefined OverflowAction
    Undefined $_.Entries.Count.ToString('N0')
    Undefined Log
  • #37027

    Mark Stepan

    Beautiful, thanks Dave, both for the specific answer and also the additional explanation. Much appreciated! Mark

You must be logged in to reply to this topic.