How do I select only the Log and # Entries from Get-EventLog -List?

This topic contains 3 replies, has 2 voices, and was last updated by Profile photo of Mark Stepan Mark Stepan 6 months ago.

Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • #37023
    Profile photo of Mark Stepan
    Mark Stepan
    Participant

    When I run Get-EventLog -List, I get 5 columns in the result. I only want 2 of them (Log and Entries). This sounds simple, but I can't seem to get it to work. When I pipe it to Select-Object (Get-EventLog -List | Select-Object Log, Entries), I get something different in the entries column.

    Thanks in advance ...

    #37024
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    That's PowerShell being a little too helpful. 🙂 The default columns you see from the formatting system don't match up with the actual properties on the object. The Entries property is actually a collection, but the default view for those EventLog object is showing you an entry count instead. This works:

    Get-EventLog -List | Select-Object @{ Name='Entries'; Expression = { $_.Entries.Count }}, Log
    
    #37025
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You can get information about what PowerShell's showing you by default with the Get-FormatData cmdlet, incidentally:

    $formatData = Get-FormatData -TypeName System.Diagnostics.EventLog
    $formatData.FormatViewDefinition[0].Control.Headers
    $formatData.FormatViewDefinition[0].Control.Rows.Columns
    
    Label          Alignment Width
    -----          --------- -----
    Max(K)             Right     8
    Retain             Right     6
    OverflowAction Undefined    18
    Entries            Right    10
    Log            Undefined     0
    
    Alignment DisplayEntry
    --------- ------------
    Undefined $_.MaximumKilobytes.ToString('N0')
    Undefined MinimumRetentionDays
    Undefined OverflowAction
    Undefined $_.Entries.Count.ToString('N0')
    Undefined Log
    
    #37027
    Profile photo of Mark Stepan
    Mark Stepan
    Participant

    Beautiful, thanks Dave, both for the specific answer and also the additional explanation. Much appreciated! Mark

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.