CODEWITHSUNDEEP
powershell
Hélder Portela
Hélder Portela

Reputation: 83

Get first value after Where-Object condition

Give the following command how to get only the first value after the where condition? 

Get-WinEvent -FilterHashtable @{Logname = 'Security';EndTime=$Time; ID = 5379} |
  select id , TimeCreated, @{ n='USER'; E ={ $_.Properties[1].Value}} |
  where USER -notlike 'condition'

I tried -MaxEvents 1 and -First 1 but that applies only to Select-Object, doesn't work with where.

Upvotes: 7

Views: 4954

Answers (1)

codewario
codewario

Reputation: 21418

Pipe your results to Select-Object -First 1 like so:

Get-WinEvent -FilterHashtable @{Logname = 'Security';EndTime=$Time; ID = 5379} |
  Select-Object Id , TimeCreated, @{ n='USER'; E ={ $_.Properties[1].Value}} | 
  Where-Object { $_.USER -notlike 'condition' } |
  Select-Object -First 1

Upvotes: 12

Related Questions