# Get-WinEvent -FilterHashTable "logname" is Case Sensitve

**URL:** <https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044>\
**Category:** PowerShell Help\
**Created:** [November 7, 2013, 6:46am UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044 "2013-11-07T06:46:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan-foxley](https://avatars.discourse-cdn.com/v4/letter/d/f17d59/32.png) [@dan-foxley](https://forums.powershell.org/u/dan-foxley)\
**Post date:** [November 7, 2013, 6:46am UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044/1 "2013-11-07T06:46:41Z")

</div>

With Powershell 3.0 in ISE remoting to a Windows Server 2008 R2, running:

```
Get-WinEvent -FilterHashTable @{logname='application';ID=1316}
```

Returns w/o issue.

Running:

```
Get-WinEvent -FilterHashTable @{LogName='application';ID=1316}
```

Returns the following error:

You must specify at least one Log, Provider or Path key-value pair.  
+ CategoryInfo :  
+ FullyQualifiedErrorId : LogProviderOrPathNeeded,Microsoft.PowerShell.Commands.GetWinEventCommand

[The Get-WinEvent help shows “LogName” being used.](http://technet.microsoft.com/en-us/library/hh849682(v=wps.620).aspx "Get-WinEvent Help")

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [November 7, 2013, 7:30am UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044/2 "2013-11-07T07:30:59Z")

</div>

So, the only difference being the case, you’re saying? PowerShell’s generally case-insensitive, but anytime you use a -Filter, the shell is just handing off to the underlying technology, which might be case-sensitive.

FWIW, both commands run without error on my Win2012R2 system, so it’s possible 2008R2 was case-sensitive. The PowerShell v3 docs would likely have been written from Win2012 behavior.

---

<div class="post-metadata">

**Author:** ![dan-foxley](https://avatars.discourse-cdn.com/v4/letter/d/f17d59/32.png) [@dan-foxley](https://forums.powershell.org/u/dan-foxley)\
**Post date:** [November 7, 2013, 9:20am UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044/3 "2013-11-07T09:20:08Z")

</div>

Correct, that is the only difference, the case. I guess it was half frustration, the error didn’t sync with the issue and it took me an hour or so to sort this out.

Thanks,  
Dan

---

<div class="post-metadata">

**Author:** ![tropez](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/tropez/32/402_2.png) [@tropez](https://forums.powershell.org/u/tropez)\
**Post date:** [December 14, 2017, 1:50pm UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044/4 "2017-12-14T13:50:54Z")

</div>

I just ran into this exact same issue. Code I had written that used “LogName” which worked fine on some boxes failed when I attempted to run them remotely using InvokeCommand with the same error the OP mentioned. When I changed my code to read “logname” (all lowercase) it functioned as expected.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:36pm UTC](https://forums.powershell.org/t/get-winevent-filterhashtable-logname-is-case-sensitve/2044/5 "2024-05-16T20:36:58Z")

</div>