2

I'm perfoming queries on the event viewer (Win32_NTLogEvent) Is there anyway to just select the top 10 or max 5 return events

I had already try with TOP, LIMIT or ROWCOUNT but nothing works

Get-WmiObject -Query 'SELECT * FROM Win32_NTLogEvent WHERE (SourceName = "Microsoft-Windows-Kernel-Power" and EventCode = "41")'
jPhizzle
  • 487
  • 1
  • 5
  • 16
daniel arias
  • 47
  • 1
  • 4

1 Answers1

4

WQL doesn't support the TOP, LIMIT or ROWCOUNT keywords; instead, you'll need to pipe the results to the Select-Object cmdlet and select the -First 10 rows, e.g.:

Get-WmiObject -Query 'SELECT * FROM Win32_NTLogEvent WHERE (SourceName = "Microsoft-Windows-Kernel-Power" and EventCode = "41")' | select -First 10

You may also need to pipe the results through the Sort-Object cmdlet first, so that the results are sorted by a given property prior to selection.

Lee Mac
  • 15,615
  • 6
  • 32
  • 80