Get-WinEvent -FilterHashTable "logname" is Case Sensitve

With Powershell 3.0 in ISE remoting to a Windows Server 2008 R2, running:

Get-WinEvent -FilterHashTable @{logname='application';ID=1316}

Returns w/o issue.


Get-WinEvent -FilterHashTable @{LogName='application';ID=1316}

Returns the following error:

You must specify at least one Log, Provider or Path key-value pair.
+ CategoryInfo :
+ FullyQualifiedErrorId : LogProviderOrPathNeeded,Microsoft.PowerShell.Commands.GetWinEventCommand

The Get-WinEvent help shows “LogName” being used.

So, the only difference being the case, you’re saying? PowerShell’s generally case-insensitive, but anytime you use a -Filter, the shell is just handing off to the underlying technology, which might be case-sensitive.

FWIW, both commands run without error on my Win2012R2 system, so it’s possible 2008R2 was case-sensitive. The PowerShell v3 docs would likely have been written from Win2012 behavior.

Correct, that is the only difference, the case. I guess it was half frustration, the error didn’t sync with the issue and it took me an hour or so to sort this out.


I just ran into this exact same issue. Code I had written that used “LogName” which worked fine on some boxes failed when I attempted to run them remotely using InvokeCommand with the same error the OP mentioned. When I changed my code to read “logname” (all lowercase) it functioned as expected.