When to use $._ in a filter

PowerShell Help
1

Fellow Powershellers,

I am trying to understand when one would and would not use $._fieldname in a filter. I have worked with two scenarios and both do the same thing

For example, lets say I am looking for when a box was rebooted.

I saw:

get-eventlog -logname system | Where-object {$_.EventID -eq ‘1074’} | ft

I then tried,

get-eventlog -logname system | Where-object EventID -eq ‘1074’ | ft

The row count appeared the same.

Can someone help explain why you would use one over the other in this scenario. Current books I have do not explain it well at least for what I just ran.

Thx

MG

 

 

2

<p style=“text-align: right;”>For simple syntax you don’t need the $, i.e. property -operator value However, if you use the scriptblock denoted by {}, you need to use $ for the current item. If your condition syntax is complex like referencing a property of a property or doing multiple comparisons, you will need the scriptblock a nd therefore the $_.</p>

3

Thx adminofthings.

4

It’s actually two different sets of parameters. The docs call it ‘script block’ or ‘comparison statement’ forms. You don’t even need the quotes in the second form. The types (scriptblock or string) and the order of the arguments determine the form. You can only use $_ inside a script block.

Where-object -filterscript {$_.EventID -eq ‘1074’}

Where-object -property EventID -eq -value 1074

where eventid -eq 1074

? eventid -eq 1074