powershell, identifying object type using get-member

Posted on 2014-01-24
Last Modified: 2014-01-27
I'm trying to get a plain event log name list from a computer. Get-Eventlog returns list of objects which may make slow to get list of multiple computers. So I want to make sure the PS code requests only list of eventlog names of the target computer. So, I tried this;

Get-EventLog -ComputerName SRV1 -List

This returned the list of event log names correctly. Then, I ran piping. It shows it's Eventlog object type!;

Get-EventLog -ComputerName SRV1 -List | Get-Member
 TypeName: System.Diagnostics.EventLog

Name                      MemberType Definition                                                                                                          
----                      ---------- ----------                                                                                                          
Disposed                  Event      System.EventHandler Disposed(System.Object, System.EventArgs)                                                       
EntryWritten              Event      System.Diagnostics.EntryWrittenEventHandler EntryWritten(System.Object, System.Diagnostics.EntryWrittenEventArgs)   
BeginInit                 Method     void BeginInit(), void ISupportInitialize.BeginInit()                                                               
Clear                     Method     void Clear()                                                                                                        
Close                     Method     void Close()                                                                                                        
CreateObjRef              Method     System.Runtime.Remoting.ObjRef CreateObjRef(type requestedType)                                                     
Dispose                   Method     void Dispose(), void IDisposable.Dispose()                                                                          
EndInit                   Method     void EndInit(), void ISupportInitialize.EndInit()                                                                   
Equals                    Method     bool Equals(System.Object obj)                                                                                      
GetHashCode               Method     int GetHashCode()                                                                                                   
GetLifetimeService        Method     System.Object GetLifetimeService()                                                                                  
GetType                   Method     type GetType()                                                                                                      
InitializeLifetimeService Method     System.Object InitializeLifetimeService()                                                                           
ModifyOverflowPolicy      Method     void ModifyOverflowPolicy(System.Diagnostics.OverflowAction action, int retentionDays)                              
RegisterDisplayName       Method     void RegisterDisplayName(string resourceFile, long resourceId)                                                      
ToString                  Method     string ToString()                                                                                                   
WriteEntry                Method     void WriteEntry(string message), void WriteEntry(string message, System.Diagnostics.EventLogEntryType type), void...
WriteEvent                Method     void WriteEvent(System.Diagnostics.EventInstance instance, Params System.Object[] values), void WriteEvent(System...
Container                 Property   System.ComponentModel.IContainer Container {get;}                                                                   
EnableRaisingEvents       Property   bool EnableRaisingEvents {get;set;}                                                                                 
Entries                   Property   System.Diagnostics.EventLogEntryCollection Entries {get;}                                                           
Log                       Property   string Log {get;set;}                                                                                               
LogDisplayName            Property   string LogDisplayName {get;}                                                                                        
MachineName               Property   string MachineName {get;set;}                                                                                       
MaximumKilobytes          Property   long MaximumKilobytes {get;set;}                                                                                    
MinimumRetentionDays      Property   int MinimumRetentionDays {get;}                                                                                     
OverflowAction            Property   System.Diagnostics.OverflowAction OverflowAction {get;}                                                             
Site                      Property   System.ComponentModel.ISite Site {get;set;}                                                                         
Source                    Property   string Source {get;set;}                                                                                            
SynchronizingObject       Property   System.ComponentModel.ISynchronizeInvoke SynchronizingObject {get;set;}    

Open in new window

Then, I see 'LogDisplayName' and I piped again to make sure I get only string of event log names.  Output looks fine. ;

Get-EventLog -ComputerName localhost -list | select logdisplayname

Then, I checked it's object type with Get-Member again and it's still EventLog object type!!!;

Get-EventLog -ComputerName localhost -list | select logdisplayname

 TypeName: Selected.System.Diagnostics.EventLog

Name           MemberType   Definition                                                
----           ----------   ----------                                                
Equals         Method       bool Equals(System.Object obj)                            
GetHashCode    Method       int GetHashCode()                                         
GetType        Method       type GetType()                                            
ToString       Method       string ToString()                                         
LogDisplayName NoteProperty System.String LogDisplayName=Active Directory Web Services

Open in new window

Then, I see LogDisplayName as note property of string type as one of its member. So I ran piping again and still an object with PSCustomObject type!!!:

Get-EventLog -ComputerName localhost -list | select logdisplayname | select logdisplayname |  gm

  TypeName: Selected.System.Management.Automation.PSCustomObject

Name           MemberType   Definition                                                
----           ----------   ----------                                                
Equals         Method       bool Equals(System.Object obj)                            
GetHashCode    Method       int GetHashCode()                                         
GetType        Method       type GetType()                                            
ToString       Method       string ToString()                                         
LogDisplayName NoteProperty System.String LogDisplayName=Active Directory Web Services

Open in new window

Where is plain string of list of event log?
Question by:crcsupport
  • 2
  • 2
LVL 40

Assisted Solution

Subsun earned 500 total points
ID: 39807746
If you just want to list the logdisplayname values, then you can try by expanding the property... For example..

Get-EventLog -ComputerName localhost -list | select -Expand logdisplayname

Open in new window


Author Comment

ID: 39809301
I'm confused about the object type it returns by select and select -expandproperty.

Get-EventLog -ComputerName localhost -list | select -Expand logdisplayname:
this returns "System.String"

Get-EventLog -ComputerName localhost -list | select logdisplayname:
this returns Selected.System.Diagnostics.EventLog

And Get-EventLog -ComputerName localhost -list | Get-Member shows that 'LogDisplayName' is 'Property' and string {get;}, which means it's string, but why do I have to expland the property when it's not propertyset and it's string??

Author Comment

ID: 39809403
I found this article regarding using expandproperty against single string property.

I'm still confused why the author had to use 'select -expandproperty name' to get the value of property of each pipelined object. Does this actually reduce the processing load going through all pipelined object, just looking into the property's value of object? I guess to get the value, the pipelined objects still have to be gone through to point the property name and value. What is the advantage of using 'select -expandproperty propertyname' instead of 'select propertyname' against a property which is not an object other than string?
LVL 40

Accepted Solution

Subsun earned 500 total points
ID: 39809608
I would say using expandproperty is depends on your requirement. In your case you want to get the property value to process hence we used Select -expandproperty..

You can also use he following code to achieve the same..
Get-EventLog -ComputerName localhost -list | %{$_.logdisplayname}

Open in new window

Regarding the object type : When you select properties, Select-Object returns new objects that have only the specified properties. 'Select-object logdisplayname' pass the same object type to pipeline, hence it displays System.Diagnostics.EventLog.

Select -expandproperty LogDisplayName gives you the Property value, and the object type of the value is string. Hence it displays System.String as object type..

following article probably explains it better..

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Microsoft Windows Server Update Service (WSUS) is free for everyone, but it lacks of some desirable features like send an e-mail to the administrator with the status of all computers on the WSUS server. This article is based on my PowerShell script …
In this previous article (, we made basic license assignments to users in O365. When I say basic, the method is the simplest way …
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question