Why sometimes powershell cmdlet "select-string" does not return any value?

Question

This command works, logfolder contains several log files, select-string will search on each file and look for the -pattern 'update'

get-childitem -recurse C:\logfolder -file | select-string -pattern "update"

But this other line won't work, it won't return any results

get-eventlog -logname system -entrytype error | select-string -pattern "terminated"

I am 100% positive that there is an event with the string "terminated", maybe I am missing some concepts here.

`Select-String` is designed to work on file objects and raw strings, not arbitrary objects. For this particular scenario, you'll want `Get-EventLog -LogName System -EntryType Error |Where-Object Message -match "terminated"` — Mathias R. Jessen, Aug 31 '21 at 09:16

js2010 · Answer 1 · 2021-08-31T14:37:08.487

select-string converts the input object to a string. Unfortunately with get-eventlog this isn't very helpful. By the way, get-eventlog has been replaced by get-winevent.

get-eventlog -logname system -entrytype error | select -first 1

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   63255 Aug 31 07:44  Error       Microsoft-Windows...         1129 The processing of Group Policy failed because o...


get-eventlog -logname system -entrytype error | select -first 1 | % { "$_" }

System.Diagnostics.EventLogEntry


get-eventlog -logname system -entrytype error | select -first 1 | select-string log

System.Diagnostics.EventLogEntry


get-eventlog -logname system -entrytype error | select -first 1 | 
  where message -match processing

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   63255 Aug 31 07:44  Error       Microsoft-Windows...         1129 The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient cond...


get-winevent @{logname='system';level=2} -maxevents 1 |
  ? message -match processing | ft -GroupBy logname

   ProviderName: System

TimeCreated                      Id LevelDisplayName Message
-----------                      -- ---------------- -------
8/31/2021 7:44:27 AM           1129 Error            The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success...

Why sometimes powershell cmdlet "select-string" does not return any value?

1 Answers1