Where-Object for filtering in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the <code>Where-Object</code> cmdlet do in PowerShell?

Where-Object filters objects from a collection based on a condition you specify. It only passes through objects that meet the condition.

beginner

How do you write a simple Where-Object filter to get numbers greater than 10 from a list?

Use: ... | Where-Object { $_ -gt 10 }. Here, $_ is the current item, and -gt means 'greater than'.

beginner

What does $_ represent inside the Where-Object script block?

$_ is a variable that holds the current object being tested in the filter. Think of it as 'this item' in the list.

intermediate

Can Where-Object filter based on object properties? Give an example.

Yes. For example, to filter processes using more than 100MB memory: Get-Process | Where-Object { $_.WorkingSet -gt 100MB }.

intermediate

What is the difference between Where-Object and ForEach-Object?

Where-Object filters items based on a condition. ForEach-Object runs a command on each item but does not filter.

What does Where-Object { $_ -eq 5 } do?

A Selects objects equal to 5

B Selects objects not equal to 5

C Selects all objects

D Deletes objects equal to 5

The condition $_ -eq 5 means 'equal to 5', so it selects only those objects.

In Where-Object, what does $_ stand for?

A The script name

B A global variable

C The last command run

D The current object in the pipeline

$_ is the current object being processed in the pipeline.

Which operator filters objects greater than 100 in Where-Object?

A -lt

B -eq

C -gt

D -ne

-gt means 'greater than'.

How would you filter files larger than 1MB using Where-Object?

A Get-ChildItem | Where-Object { $_ -eq 1MB }

B Get-ChildItem | Where-Object { $_.Length -gt 1MB }

C Get-ChildItem | Where-Object { $_.Size -lt 1MB }

D Get-ChildItem | Where-Object { $_.Length -lt 1MB }

Length is the file size property, and -gt 1MB filters files larger than 1MB.

Which cmdlet would you use to run a command on each object without filtering?

A ForEach-Object

B Where-Object

C Select-Object

D Sort-Object

ForEach-Object runs commands on each object but does not filter.

Explain how Where-Object works to filter items in a PowerShell pipeline.

Think about how you pick only certain fruits from a basket based on color.

Describe how to filter processes that use more than 50MB of memory using Where-Object.

Remember to check the property that shows memory usage.

Practice

1. What does the Where-Object cmdlet do in PowerShell?

easy

A. Filters objects in a collection based on a condition

B. Sorts objects alphabetically

C. Creates new objects from existing ones

D. Deletes objects from a collection

Solution

1. Step 1: Understand the purpose of Where-Object

   Where-Object is used to filter items in a collection by applying a condition to each item.

2. Step 2: Compare options with the purpose

   Only Filters objects in a collection based on a condition correctly describes filtering based on a condition. Sorting, creating, or deleting are different operations.

3. Final Answer:

   Filters objects in a collection based on a condition -> Option A

4. Quick Check:

   Where-Object filters collections = A [OK]

Hint: Where-Object selects items matching a condition [OK]

Common Mistakes:

• Confusing filtering with sorting
• Thinking it creates or deletes objects
• Ignoring the condition part

2. Which of the following is the correct syntax to filter processes with CPU usage greater than 100 using Where-Object?

easy

A. Get-Process | Where-Object { CPU > 100 }

B. Get-Process | Where-Object { $_.CPU -gt 100 }

C. Get-Process | Where-Object CPU -gt 100

D. Get-Process | Where-Object CPU > 100

Solution

1. Step 1: Identify correct use of script block and $_ variable

   Where-Object requires a script block with curly braces and uses $_ to refer to the current object.

2. Step 2: Check each option's syntax

   Get-Process | Where-Object { $_.CPU -gt 100 } correctly uses { $_.CPU -gt 100 }. Versions without the script block braces {} are incorrect. The version with { CPU > 100 } misses $_ before CPU.

3. Final Answer:

   Get-Process | Where-Object { $_.CPU -gt 100 } -> Option B

4. Quick Check:

   { $_.Property -gt value } syntax = D [OK]

Hint: Always use { $_.Property -operator value } inside Where-Object [OK]

Common Mistakes:

• Omitting curly braces {}
• Not using $_ to reference current object
• Writing condition outside script block

3. What will be the output of this command?

1..5 | Where-Object { $_ % 2 -eq 0 }

medium

A. [1, 3, 5]

B. [1, 2, 3, 4, 5]

C. [2, 4]

D. Error: Invalid operator

Solution

1. Step 1: Understand the input and condition

   The input is numbers 1 to 5. The condition filters numbers where remainder when divided by 2 equals 0 (even numbers).

2. Step 2: Apply the condition to each number

   Numbers 2 and 4 satisfy the condition (2 % 2 = 0, 4 % 2 = 0). Others do not.

3. Final Answer:

   [2, 4] -> Option C

4. Quick Check:

   Filter even numbers = [2, 4] [OK]

Hint: Use modulo (%) to filter even numbers [OK]

Common Mistakes:

• Confusing even and odd numbers
• Expecting all numbers as output
• Thinking syntax causes error

4. Identify the error in this command:

Get-Service | Where-Object $_.Status -eq 'Running'

medium

A. Missing curly braces around the condition

B. Incorrect property name 'Status'

C. Wrong operator used for comparison

D. No error, command is correct

Solution

1. Step 1: Check Where-Object syntax

   Where-Object requires the condition inside curly braces {} to form a script block.

2. Step 2: Analyze the given command

   The command misses curly braces around $_.Status -eq 'Running', causing syntax error.

3. Final Answer:

   Missing curly braces around the condition -> Option A

4. Quick Check:

   Where-Object needs { condition } [OK]

Hint: Always wrap condition in { } for Where-Object [OK]

Common Mistakes:

• Omitting curly braces
• Assuming property names are wrong without checking
• Confusing operators

5. You have a list of files with sizes in bytes. Which command filters files larger than 1MB (1048576 bytes) and selects only their names?

Get-ChildItem | Where-Object { $_.Length -gt 1048576 } | ???

What should replace ????

hard

A. Sort-Object Length

B. Where-Object Name

C. Format-Table Length

D. Select-Object Name

Solution

1. Step 1: Understand the filtering part

   Where-Object filters files with Length greater than 1048576 bytes (1MB).

2. Step 2: Identify how to select only file names

   Select-Object Name extracts only the Name property from the filtered files.

3. Final Answer:

   Select-Object Name -> Option D

4. Quick Check:

   Select-Object Name for properties = C [OK]

Hint: Use Select-Object to pick specific properties [OK]

Common Mistakes:

• Using Where-Object instead of Select-Object to pick properties
• Sorting instead of selecting
• Formatting output without selecting needed data