Error when using Get-WinEvent FilterHashtable in Where-Object

PowerShell Help
1

I’m getting an error message for my pipeline, and I’m not sure how to fix it. I’m not sure if I’m completely sure what the error message is referring to or the data structure at the beginning of my pipeline.

This is the line:

$eventInitTerminate = Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object -PipelineVariable Message -Match 'Channel'

This is the error:

Where-Object : The specified operator requires both the -Property and -Value parameters

I tried changing it to this per someone’s recommendation, but still get an error:

$eventInitTerminate = Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object (-Property Message) (-Match 'Channel')

Error:

-Property : The term '-Property' is not recognized as the name of a cmdlet, function, script file, or operable program.

Any idea how to properly use the variable returned by Get-WinEvent -FilterHashtable so that it works with Where-Object? A specific example with my info would be helpful. Thanks a lot!

I’ve searched online and haven’t found a good example or explanation.

2

You may (re-)read the help topic for the cmdlet to learn how to use it

In this case it should be something like this:

$FilterHashtable = @{
    LogName      = 'Application';
    ProviderName = 'chromoting';
    StartTime    = $initTime;
    EndTime      = $crashOccurredTime
}

$eventInitTerminate = 
Get-WinEvent -FilterHashtable $FilterHashtable -ErrorAction SilentlyContinue | 
Where-Object -Property 'Message' -Match -Value 'Channel'

… and I reformatted it to make it easier readable. :wink:

Another option would be to use the old syntax for Where-Object like this:

Where-Object {$_.Message -Match 'Channel'}

… this way you could even combine more than one filter / condition inside the curly braces. :wink:

1 Like
3

Nice! Thank you! I finally don’t have the errors!!! :smiley: