How do I select only the Log and # Entries from Get-EventLog -List?

This topic contains 3 replies, has 2 voices, and was last updated by Profile photo of Mark Stepan Mark Stepan 8 months, 2 weeks ago.

  • Author
    Posts
  • #37023
    Profile photo of Mark Stepan
    Mark Stepan
    Participant

    When I run Get-EventLog -List, I get 5 columns in the result. I only want 2 of them (Log and Entries). This sounds simple, but I can't seem to get it to work. When I pipe it to Select-Object (Get-EventLog -List | Select-Object Log, Entries), I get something different in the entries column.

    Thanks in advance ...

  • #37024
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    That's PowerShell being a little too helpful. 🙂 The default columns you see from the formatting system don't match up with the actual properties on the object. The Entries property is actually a collection, but the default view for those EventLog object is showing you an entry count instead. This works:

    Get-EventLog -List | Select-Object @{ Name='Entries'; Expression = { $_.Entries.Count }}, Log
    
  • #37025
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    You can get information about what PowerShell's showing you by default with the Get-FormatData cmdlet, incidentally:

    $formatData = Get-FormatData -TypeName System.Diagnostics.EventLog
    $formatData.FormatViewDefinition[0].Control.Headers
    $formatData.FormatViewDefinition[0].Control.Rows.Columns
    
    Label          Alignment Width
    -----          --------- -----
    Max(K)             Right     8
    Retain             Right     6
    OverflowAction Undefined    18
    Entries            Right    10
    Log            Undefined     0
    
    Alignment DisplayEntry
    --------- ------------
    Undefined $_.MaximumKilobytes.ToString('N0')
    Undefined MinimumRetentionDays
    Undefined OverflowAction
    Undefined $_.Entries.Count.ToString('N0')
    Undefined Log
    
  • #37027
    Profile photo of Mark Stepan
    Mark Stepan
    Participant

    Beautiful, thanks Dave, both for the specific answer and also the additional explanation. Much appreciated! Mark

You must be logged in to reply to this topic.