Prof. Powershell

Be Selective with Select-Object Cmdlet

The Select-Object cmdlet lets you get what you always want, at least as parameters are concerned.

• By Jeffery Hicks
• 01/11/2011

In my younger, more carefree days, I played my share of card games. Most of the time I needed a little help from the dealer in selecting just the cards I needed. Today it is no longer cards -- instead, Windows administration and PowerShell is my dealer.

When you run a PowerShell expression, cmdlets return collections of objects. But sometimes you only want certain ones. The Select-Object cmdlet offers a few parameters to help you be as picky as necessary. Here's my favorite example:

PS C:\> get-process | sort Workingset -Descending | Select -first 5

Handles NPM(K)  PM(K)  WS(K) VM(M)   CPU(s)   Id ProcessName
------- ------  -----  ----- -----   ------   -- -----------
    522    138 497064 520268   706 2,943.27 4896 firefox
    761     75 323412 320520   633   254.70 3696 sllauncher
    594     36 203348 209132   343   136.17 1160 svchost
    447     68  99916 120064   298   175.81 3760 thunderbird
   1005     83  66572  95764   305   140.56 3508 explorer

With this expression I retrieved all processes, then sorted the output by the WorkingSet property in descending order. The process objects were then piped to Select-Object, which returned just the first five. The remaining process objects were discarded in the pipeline. The end result is a Top 5 process list, at least by WorkingSet.

Select-Object also has a –Last parameter. Let's grab the last five lines of the local Windows Update log:

PS C:\> get-content C:\windows\WindowsUpdate.log | select -last 5
2010-12-30 10:39:32:500 1204 3cc  Report CWERReporter finishing eve...
2010-12-30 10:51:18:629 1204 3cc  Report Uploading 2 events using c...
2010-12-30 10:51:18:636 1204 3cc  Report Reporter successfully uplo...
2010-12-30 11:27:18:823 1204 ee4  AU     Successfully wrote event f...
2010-12-30 11:27:23:827 1204 1754 Report CWERReporter finishing eve...

One important thing to keep in mind when using these parameters, especially -First, is that Select-Object has to process all the incoming objects before it can return the specified subset. For expressions that return thousands of objects you might notice a delay before Select-Object returns x number of objects. I'm trusting that this performance issue will be worked out in future versions.

You can also use Select-Object to skip x number of objects. I can even use this with non-PowerShell commands:

PS C:\> netstat -e | select-object -skip 2
                     Received      Sent
Bytes               588304877 218460126
Unicast packets       4289941   2388507
Non-unicast packets    284312     37112
Discards                    0         0
Errors                      0         0
Unknown protocols           0

The Netstat.exe command, when used in PowerShell, writes a collection of strings to the pipeline and all I've done is skipped the header lines.

Lastly, because objects are passed to Select-Object as a collection or array, you can reference specific items by their index number. In PowerShell arrays start counting at 0:

PS C:\> get-service | select -Index 1

Status  Name DisplayName
------  ---- -----------
Stopped  ALG Application Layer Gateway Service

This is the second service object from Get-Service. By the way, in this particular case, you would get the result with this:

PS C:\> get-service | select -skip 1 -first 1

Or specify several indices:

PS C:\> get-service | select -Index 0,2,4,6,8,10

Status Name                DisplayName
------ ----                -----------
Running AeLookupSvc        Application Experience
Stopped AppIDSvc           Application Identity
Stopped AppMgmt            Application Management
Running AudioEndpointBu... Windows Audio Endpoint Builder
Stopped AxInstSV           ActiveX Installer (AxInstSV)
Running BFE                Base Filtering Engine

Hopefully you'll have more practical applications.