CODEWITHSUNDEEP
powershell
JohnC
JohnC

Reputation: 3257

An empty pipe element is not allowed, Get-WinEvent -FilterHashtable

I'm new to Powershell (v5) but found on the web a way to list all non empty logs e.g. in the last 30 minutes. However, I cannot redirect the output to a file. Any suggestions gratefully received.

$time1 = New-TimeSpan -Minutes 30
$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | 
Select-Object -ExpandProperty LogName
Get-WinEvent -FilterHashtable @{LogName=$logs; Level=1,2,3; StartTime=(Get-Date)-$time1}
| out-file c:\temp\test1.txt

Upvotes: 1

Views: 1032

Answers (1)

mklement0
mklement0

Reputation: 437176

There are two ways to make PowerShell look for the continuation of a pipeline on the next line:

  • Place | at the end of a line.

    • More generally: any statement that invariably needs more tokens to be syntactically valid causes PowerShell to keep parsing on the next line.

    • Update: In PowerShell [Core] v7+ you may alternative place the | at the start of the (very) next line.

  • Use an explicit line continuation by placing ` (PowerShell's escape character) at the very end of a line (not even whitespace is allowed after).

What you tried:

Update: As implied above, your command now does work in PowerShell [Core] v7+.
The following explanation therefore applies only to PowerShell 6.x and below, including Windows PowerShell.

PowerShell reads the following as two statements:

Get-WinEvent -FilterHashtable @{LogName=$logs; Level=1,2,3; StartTime=(Get-Date)-$time1}
| out-file c:\temp\test1.txt

The Get-WinEvent line is syntactically complete by itself, so PowerShell considers it its own statement.

Thus, to PowerShell, the next statement starts with |, which prompts the error message you saw (there must be a command or expression before a statement's first |).

Upvotes: 2

Related Questions