Where-Object for filtering in PowerShell

Introduction

Use Where-Object to pick only the items you want from a list or collection. It helps you filter data easily.

You have a list of files and want only those bigger than 1MB.

You want to find processes using more than 50% CPU.

You need to select users from a list who are active.

You want to filter events from a log by date.

You want to get services that are currently running.

Syntax

PowerShell

collection | Where-Object { condition }

The condition inside the braces { } decides which items to keep.

Use $_ to represent the current item in the collection.

Examples

Selects processes using more than 100 seconds of CPU time.

PowerShell

Get-Process | Where-Object { $_.CPU -gt 100 }

Filters files to only those with the .txt extension.

PowerShell

Get-ChildItem | Where-Object { $_.Extension -eq ".txt" }

Filters numbers to only even numbers.

PowerShell

$numbers = 1..10
$numbers | Where-Object { $_ % 2 -eq 0 }

Sample Program

This script gets all files in the current folder, filters those larger than 1,000,000 bytes (1MB), and prints their names.

PowerShell

$files = Get-ChildItem -Path .
$largeFiles = $files | Where-Object { $_.Length -gt 1000000 }
foreach ($file in $largeFiles) {
    Write-Output $file.Name
}

Important Notes

Where-Object works with any collection, not just files or processes.

You can combine multiple conditions using -and or -or inside the braces.

Remember $_ always means the current item being checked.

Summary

Where-Object helps you filter collections by conditions.

Use $_ to refer to each item inside the filter block.

It makes scripts cleaner by selecting only what you need.

Practice

1. What does the Where-Object cmdlet do in PowerShell?

easy

A. Filters objects in a collection based on a condition

B. Sorts objects alphabetically

C. Creates new objects from existing ones

D. Deletes objects from a collection

Solution

1. Step 1: Understand the purpose of Where-Object

   Where-Object is used to filter items in a collection by applying a condition to each item.

2. Step 2: Compare options with the purpose

   Only Filters objects in a collection based on a condition correctly describes filtering based on a condition. Sorting, creating, or deleting are different operations.

3. Final Answer:

   Filters objects in a collection based on a condition -> Option A

4. Quick Check:

   Where-Object filters collections = A [OK]

Hint: Where-Object selects items matching a condition [OK]

Common Mistakes:

• Confusing filtering with sorting
• Thinking it creates or deletes objects
• Ignoring the condition part

2. Which of the following is the correct syntax to filter processes with CPU usage greater than 100 using Where-Object?

easy

A. Get-Process | Where-Object { CPU > 100 }

B. Get-Process | Where-Object { $_.CPU -gt 100 }

C. Get-Process | Where-Object CPU -gt 100

D. Get-Process | Where-Object CPU > 100

Solution

1. Step 1: Identify correct use of script block and $_ variable

   Where-Object requires a script block with curly braces and uses $_ to refer to the current object.

2. Step 2: Check each option's syntax

   Get-Process | Where-Object { $_.CPU -gt 100 } correctly uses { $_.CPU -gt 100 }. Versions without the script block braces {} are incorrect. The version with { CPU > 100 } misses $_ before CPU.

3. Final Answer:

   Get-Process | Where-Object { $_.CPU -gt 100 } -> Option B

4. Quick Check:

   { $_.Property -gt value } syntax = D [OK]

Hint: Always use { $_.Property -operator value } inside Where-Object [OK]

Common Mistakes:

• Omitting curly braces {}
• Not using $_ to reference current object
• Writing condition outside script block

3. What will be the output of this command?

1..5 | Where-Object { $_ % 2 -eq 0 }

medium

A. [1, 3, 5]

B. [1, 2, 3, 4, 5]

C. [2, 4]

D. Error: Invalid operator

Solution

1. Step 1: Understand the input and condition

   The input is numbers 1 to 5. The condition filters numbers where remainder when divided by 2 equals 0 (even numbers).

2. Step 2: Apply the condition to each number

   Numbers 2 and 4 satisfy the condition (2 % 2 = 0, 4 % 2 = 0). Others do not.

3. Final Answer:

   [2, 4] -> Option C

4. Quick Check:

   Filter even numbers = [2, 4] [OK]

Hint: Use modulo (%) to filter even numbers [OK]

Common Mistakes:

• Confusing even and odd numbers
• Expecting all numbers as output
• Thinking syntax causes error

4. Identify the error in this command:

Get-Service | Where-Object $_.Status -eq 'Running'

medium

A. Missing curly braces around the condition

B. Incorrect property name 'Status'

C. Wrong operator used for comparison

D. No error, command is correct

Solution

1. Step 1: Check Where-Object syntax

   Where-Object requires the condition inside curly braces {} to form a script block.

2. Step 2: Analyze the given command

   The command misses curly braces around $_.Status -eq 'Running', causing syntax error.

3. Final Answer:

   Missing curly braces around the condition -> Option A

4. Quick Check:

   Where-Object needs { condition } [OK]

Hint: Always wrap condition in { } for Where-Object [OK]

Common Mistakes:

• Omitting curly braces
• Assuming property names are wrong without checking
• Confusing operators

5. You have a list of files with sizes in bytes. Which command filters files larger than 1MB (1048576 bytes) and selects only their names?

Get-ChildItem | Where-Object { $_.Length -gt 1048576 } | ???

What should replace ????

hard

A. Sort-Object Length

B. Where-Object Name

C. Format-Table Length

D. Select-Object Name

Solution

1. Step 1: Understand the filtering part

   Where-Object filters files with Length greater than 1048576 bytes (1MB).

2. Step 2: Identify how to select only file names

   Select-Object Name extracts only the Name property from the filtered files.

3. Final Answer:

   Select-Object Name -> Option D

4. Quick Check:

   Select-Object Name for properties = C [OK]

Hint: Use Select-Object to pick specific properties [OK]

Common Mistakes:

• Using Where-Object instead of Select-Object to pick properties
• Sorting instead of selecting
• Formatting output without selecting needed data