How do I select only the Log and # Entries from Get-EventLog -List?

PowerShell Help
1

When I run Get-EventLog -List, I get 5 columns in the result. I only want 2 of them (Log and Entries). This sounds simple, but I can’t seem to get it to work. When I pipe it to Select-Object (Get-EventLog -List | Select-Object Log, Entries), I get something different in the entries column.

Thanks in advance …

2

That’s PowerShell being a little too helpful. :slight_smile: The default columns you see from the formatting system don’t match up with the actual properties on the object. The Entries property is actually a collection, but the default view for those EventLog object is showing you an entry count instead. This works:

Get-EventLog -List | Select-Object @{ Name='Entries'; Expression = { $_.Entries.Count }}, Log
3

You can get information about what PowerShell’s showing you by default with the Get-FormatData cmdlet, incidentally:

$formatData = Get-FormatData -TypeName System.Diagnostics.EventLog
$formatData.FormatViewDefinition[0].Control.Headers
$formatData.FormatViewDefinition[0].Control.Rows.Columns

Label          Alignment Width
-----          --------- -----
Max(K)             Right     8
Retain             Right     6
OverflowAction Undefined    18
Entries            Right    10
Log            Undefined     0

Alignment DisplayEntry
--------- ------------
Undefined $_.MaximumKilobytes.ToString('N0')
Undefined MinimumRetentionDays
Undefined OverflowAction
Undefined $_.Entries.Count.ToString('N0')
Undefined Log
4

Beautiful, thanks Dave, both for the specific answer and also the additional explanation. Much appreciated! Mark