MaxEvents in filter

Posted on 2012-08-15
Last Modified: 2012-08-15
I need to be able to get the most recent event of a specific ID.  For example, if I want to get Event 805:

Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName $PrintServer -MaxEvents 1|
     Where-Object{$ -eq 805}|

Open in new window

The problem with this it gets the last 1 event in the PrintService/Operational log, and if it doesn't happen to be ID 805 then it returns nothing.  How do I specify that I want only the most recent event of that specific ID?
Question by:bigbigpig
    LVL 3

    Accepted Solution

    You  are asking for most recent event before specifying "Where" condition.

    You should filter using Hashtable where you specify both logName and event ID, like this, in advance:

    Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-PrintService/Operational'; id=805}  -ComputerName $PrintServer -MaxEvents 1

    LVL 10

    Author Comment

    When I use a hashtable I can't pull values from it can I?  Here's the rest of the script, I need to be able to pull the values from the XML event data and write it to CSV.  Everything works fine, except for getting the most recent 1 event.

    Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName $PrintServer -MaxEvents 2|
         Where-Object{$ -eq 805}|
            $strOutput = $PrintServer+ "," +$_.timecreated+ "," +$($_.Properties[3].Value)+ "," +$($_.Properties[7].Value)+ "," +$_.UserID
    		write-output $strOutput | Out-File $csvfile805 -append

    Open in new window

    LVL 3

    Expert Comment

    You should be able to pipe its output.

    When you run the command of my last posting by itself, do you get correct output on the screen? If so, just replace first 2 lines of your script with it, but do keep the last pipe '|'.

    In other words, put my command before
    | foreach-object {
    etc. etc.
    LVL 10

    Author Comment

    Absolutely right, I forgot the dang pipe before so the ForEach-Object was returning a null error.  Works great - thank you!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Training Course: Java/J2EE and SOA

    This course will cover both core and advanced Java concepts like Database connectivity, Threads, Exception Handling, Collections, JSP, Servlets, XMLHandling, and more. You'll also learn various Java frameworks like Hibernate and Spring.

    Why would I want to create a function for tracking messages? I am glad you asked. As with most monotonous/routine tasks, human error tends to creep in after doing the same task over and over again. By creating a function, you load the function once…
    Hi all.   The other day I had to change the passwords for a bunch of users on the fly. Because they were so many, I decided to do it in an automated way and I would like to share it with you all.   If you are not doing it directly in a Domain Co…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now