0

I'm doing the following powershell line, and for some reason it's finding a syntax error with it, but I'm not sure why, and I can't find it in an internet search:

 $eventInitTerminate = Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object -PipelineVariable Message -Match 'Channel'

I can see Channel in my chromoting ProviderName for Application event-log, but for some reason it's not working here and I get the error message:

Where-Object : The specified operator requires both the -Property and -Value parameters. Provide values for both parameters, and then try the
command again.
At E:\dirName\CrashAfterExclude_test2.ps1:25 char:192
+ ... tlyContinue | Where-Object -PipelineVariable Message -Match 'Channel'
+                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Where-Object], PSArgumentException
    + FullyQualifiedErrorId : ValueNotSpecifiedForWhereObject,Microsoft.PowerShell.Commands.WhereObjectCommand
Michele
  • 3,617
  • 12
  • 47
  • 81
  • 3
    `Where-Object -PipelineVariable Message -Match 'Channel'` should be `Where-Object -Property Message -Match 'Channel'`. Unless your intent is to use the object down the pipeline as a whole, `-PipelineVariable` is out of place. It's currently being read as `Where-Object (-PipelineVariable Message) (-Match 'Channel)'` where `-Match` is expecting the property name. – Abraham Zinala Aug 16 '22 at 21:38
  • You didn't name the pipeline variable. – js2010 Aug 17 '22 at 04:33
  • @AbrahamZinala I tried $eventInitTerminate = Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object (-Property Message) (-Match 'Channel') and still get error -Property : The term '-Property' is not recognized as the name of a cmdlet, function, script file, or operable program. – Michele Aug 17 '22 at 13:30
  • @js2010 what do you mean. The variable is part of the Get-WinEvent filterhashtable object returned. How do you recommend naming it? Wouldn't it just be a matter of accessing the data from the returned info? Isn't that what I'm doing? What else would I do differently? – Michele Aug 17 '22 at 13:35
  • `Where-Object -PipelineVariable myvar Message -Match 'Channel | % { echo $myvar }' ` – js2010 Aug 17 '22 at 13:36
  • I'm not sure how I'd fit that into the entire pipeline. Isn't Message the variable? $eventInitTerminate = Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object -PipelineVariable Message -Match 'Channel' – Michele Aug 17 '22 at 14:32
  • 1
    Message is the implied -property parameter. I don't think you know what -pipelinevariable does. You don't need the echo part. That was just an example to understand it. `Where-Object Message -Match 'Channel'` – js2010 Aug 17 '22 at 16:23
  • Thanks, I got it working with this: $eventInitTerminate = {Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='chromoting';StartTime=$initTime;EndTime=$crashOccurredTime;} -ErrorAction SilentlyContinue | Where-Object -Property 'Message' -Match -Value 'Channel' – Michele Aug 23 '22 at 16:51

0 Answers0