Where-Object for filtering in PowerShell - Step-by-Step Execution

Concept Flow - Where-Object for filtering

Start with a collection

↓

Apply Where-Object filter

↓

Evaluate condition on each item

↓

If True

→Keep item

↓

If False

→Discard item

↓

Output filtered collection

The flow starts with a collection, applies a filter condition to each item, keeps items that match, and outputs the filtered collection.

Execution Sample

PowerShell

1..5 | Where-Object { $_ -gt 3 }
# Filters numbers greater than 3 from 1 to 5

This code filters numbers from 1 to 5, keeping only those greater than 3.

Execution Table

Step	Input Item ($_)	Condition ($_ -gt 3)	Result	Action	Output So Far
1	1	False	Discard	Skip item	[]
2	2	False	Discard	Skip item	[]
3	3	False	Discard	Skip item	[]
4	4	True	Keep	Add to output	[4]
5	5	True	Keep	Add to output	[4, 5]

💡 All items processed; output contains only items where condition is True.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
$_	N/A	1	2	3	4	5	N/A
Output	[]	[]	[]	[]	[4]	[4, 5]	[4, 5]

Key Moments - 2 Insights

Why does the output only include 4 and 5, not 3?

Because the condition $_ -gt 3 means 'greater than 3'. The number 3 is not greater than 3, so it is discarded as shown in steps 3 of the execution_table.

What does $_ represent inside the Where-Object script block?

The $_ variable represents the current item being checked from the input collection, as seen in the execution_table under 'Input Item ($_)' column.

Visual Quiz - 3 Questions

Look at the execution table, what is the output after processing the 4th item?

A [1, 2, 3, 4]

B [3, 4]

C [4]

D [4, 5]

💡 Hint

Check the 'Output So Far' column at step 4 in the execution_table.

At which step does the condition $_ -gt 3 become true for the first time?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'Condition ($_ -gt 3)' column in the execution_table.

If the condition changed to $_ -ge 3, what would be the output after all steps?

A [3, 4, 5]

B [4, 5]

C [1, 2, 3]

D [1, 2, 3, 4, 5]

💡 Hint

Consider that -ge means 'greater than or equal to' and check which items satisfy this.

Concept Snapshot

Where-Object filters items from a collection.
Syntax: collection | Where-Object { condition }
$_ is the current item.
Only items where condition is True are kept.
Useful for selecting specific data easily.

Full Transcript

This visual execution shows how Where-Object filters a list of numbers from 1 to 5 by keeping only those greater than 3. Each number is checked one by one. If the number is greater than 3, it is added to the output. Otherwise, it is skipped. The variable $_ holds the current number being checked. The output after processing all numbers is [4, 5]. This helps beginners see how filtering works step-by-step.

Practice

1. What does the Where-Object cmdlet do in PowerShell?

easy

A. Filters objects in a collection based on a condition

B. Sorts objects alphabetically

C. Creates new objects from existing ones

D. Deletes objects from a collection

Solution

1. Step 1: Understand the purpose of Where-Object

   Where-Object is used to filter items in a collection by applying a condition to each item.

2. Step 2: Compare options with the purpose

   Only Filters objects in a collection based on a condition correctly describes filtering based on a condition. Sorting, creating, or deleting are different operations.

3. Final Answer:

   Filters objects in a collection based on a condition -> Option A

4. Quick Check:

   Where-Object filters collections = A [OK]

Hint: Where-Object selects items matching a condition [OK]

Common Mistakes:

• Confusing filtering with sorting
• Thinking it creates or deletes objects
• Ignoring the condition part

2. Which of the following is the correct syntax to filter processes with CPU usage greater than 100 using Where-Object?

easy

A. Get-Process | Where-Object { CPU > 100 }

B. Get-Process | Where-Object { $_.CPU -gt 100 }

C. Get-Process | Where-Object CPU -gt 100

D. Get-Process | Where-Object CPU > 100

Solution

1. Step 1: Identify correct use of script block and $_ variable

   Where-Object requires a script block with curly braces and uses $_ to refer to the current object.

2. Step 2: Check each option's syntax

   Get-Process | Where-Object { $_.CPU -gt 100 } correctly uses { $_.CPU -gt 100 }. Versions without the script block braces {} are incorrect. The version with { CPU > 100 } misses $_ before CPU.

3. Final Answer:

   Get-Process | Where-Object { $_.CPU -gt 100 } -> Option B

4. Quick Check:

   { $_.Property -gt value } syntax = D [OK]

Hint: Always use { $_.Property -operator value } inside Where-Object [OK]

Common Mistakes:

• Omitting curly braces {}
• Not using $_ to reference current object
• Writing condition outside script block

3. What will be the output of this command?

1..5 | Where-Object { $_ % 2 -eq 0 }

medium

A. [1, 3, 5]

B. [1, 2, 3, 4, 5]

C. [2, 4]

D. Error: Invalid operator

Solution

1. Step 1: Understand the input and condition

   The input is numbers 1 to 5. The condition filters numbers where remainder when divided by 2 equals 0 (even numbers).

2. Step 2: Apply the condition to each number

   Numbers 2 and 4 satisfy the condition (2 % 2 = 0, 4 % 2 = 0). Others do not.

3. Final Answer:

   [2, 4] -> Option C

4. Quick Check:

   Filter even numbers = [2, 4] [OK]

Hint: Use modulo (%) to filter even numbers [OK]

Common Mistakes:

• Confusing even and odd numbers
• Expecting all numbers as output
• Thinking syntax causes error

4. Identify the error in this command:

Get-Service | Where-Object $_.Status -eq 'Running'

medium

A. Missing curly braces around the condition

B. Incorrect property name 'Status'

C. Wrong operator used for comparison

D. No error, command is correct

Solution

1. Step 1: Check Where-Object syntax

   Where-Object requires the condition inside curly braces {} to form a script block.

2. Step 2: Analyze the given command

   The command misses curly braces around $_.Status -eq 'Running', causing syntax error.

3. Final Answer:

   Missing curly braces around the condition -> Option A

4. Quick Check:

   Where-Object needs { condition } [OK]

Hint: Always wrap condition in { } for Where-Object [OK]

Common Mistakes:

• Omitting curly braces
• Assuming property names are wrong without checking
• Confusing operators

5. You have a list of files with sizes in bytes. Which command filters files larger than 1MB (1048576 bytes) and selects only their names?

Get-ChildItem | Where-Object { $_.Length -gt 1048576 } | ???

What should replace ????

hard

A. Sort-Object Length

B. Where-Object Name

C. Format-Table Length

D. Select-Object Name

Solution

1. Step 1: Understand the filtering part

   Where-Object filters files with Length greater than 1048576 bytes (1MB).

2. Step 2: Identify how to select only file names

   Select-Object Name extracts only the Name property from the filtered files.

3. Final Answer:

   Select-Object Name -> Option D

4. Quick Check:

   Select-Object Name for properties = C [OK]

Hint: Use Select-Object to pick specific properties [OK]

Common Mistakes:

• Using Where-Object instead of Select-Object to pick properties
• Sorting instead of selecting
• Formatting output without selecting needed data