Alright, now that you've seen these commands kind of individually,
let's put them together because this is what you
typically will be doing in PowerShell.
Let's go ahead, and again, let's do Get‑Process,
and let's sort on that working set property in Descending
order and then just tell PowerShell, hey,
all I care about are the first 5.
So on my computer, these are the top five processes based upon the working size,
or the amount of memory that they are using,
no scripting, really simple.
Again,
just kind of think about what PowerShell is doing or
what you want PowerShell to do, get me all the processes,
sort them, select them, nothing cryptic,
really nothing difficult here,
other than getting your head around this idea of
objects moving through the pipeline.
Let's do another one here.
I'm going to get a listing of all the files in my temporary folder,
and I'm going to measure how much space they're taking.
So I'm going to measure the length property,
and I'm going to use the AllStats parameter,
which was introduced in PowerShell 7 for measure object.
So this is going to give me all the things that I can do,
but I want to select all those properties except,
and that's the ExcludeProperty,
I don't want to see the Property output from the measure object result.
So instead,
what I get is all of the values that measure object can do, so I get the Count,
the Average, the Sum, the Maximum, the Minimum,
and the StandardDeviation if I really needed that sort of thing.
PowerShell will do what I tell it to do as long as I have an idea
in my head about what I need it to do.
Let's revisit event logs.
So let's do get‑winevent, and again, I'm going to list all the logs,
Sort them on the FileSize because I know that that is a property,
sort them in Descending order, and then select just the first 10,
so this is going to give me the first 10 event logs,
but then all I want to see in the result is the Logname,
RecordCount, and file size, and there we go.
Again, a very easy,
simple report to see the event logs on my system and
how much space they might be taking.
We have been looking at the logs.
Now I want to discover what's inside the logs.
My previous example was just listening to log file.
Now I want to know, hey, what entries are in there?
What might be using or causing problems for me, say, in the system event log?
So let's do a little discovery.
I'm going to just grab one representative entry and select all the properties.
I can then scroll and discover, okay,
what property names do I want so I can see the
corresponding values? Once I see that, I can run a command like this.
Let's do get‑winevent, and I'm just going to get the first 1000,
or should say,
the last 1000 entries from the system event log. Now, I'm going to
Group them on the Providername, and in this case,
I don't really care about the entries themselves.
I just want to know the Providername,
which in this case is going to be the source, and how many items
am I getting for each Providername or source?
So I'm then going to sort on the Count property. Again, you have to think about
what PowerShell is doing, what's happening in the pipeline.
Get‑winevent is getting me event log records.
I'm then grouping them.
Group object is now writing a Group object to the pipeline
that has its own, has different properties.
I'm not going to sort on that Group object.
That result then gets written to the pipeline,
and I'm going to select just the first 10, and again, just to
make it a little interesting, I'm going to pipe this to another
command called Out‑ConsoleGridView.
Now,
this command you'll have to install in order to use it, and I have a note in the
demo file on how to install the module to give this to you.
This is kind of like Out‑GridView,
except it does it in the console, kind of a nice way, so it's a
different way of working with information.
So there, I can see in the system event log, these are the
entries that are causing the most logs to be recorded, so
my GroupPolicy event. Now, a lot of those could be information.
I haven't added any other filtering for errors or warnings.
You can look at the help for Get‑WinEvent to see how to do that.
I told PowerShell what to do,
and it went ahead and did it, and Escape just gets you out of that.
So working with multiple objects at once is really easy,
and it's really what you should look for when working in
PowerShell. Sometimes though that's not possible.
So let's go back to the slides, and let me cover another way to work with objects in the pipeline.