Filtering Objects (Where-Object)
Command Equivalents
| Linux Task | PowerShell Cmdlet | Aliases |
|---|---|---|
Filtering text output (e.g., ... | grep "text") | ... | Where-Object { <condition> } | where, ? |
Description
The Where-Object cmdlet is a cornerstone of PowerShell, acting as a universal filter for any collection of objects. Its purpose is to examine each object coming through the pipeline and let only those that meet a specific condition pass through to the next command.
It is PowerShell’s object-oriented answer to text-based filtering tools like grep and awk. Instead of matching text patterns, you filter based on the actual properties and values of the objects.
The Script Block and $_
The filtering condition for Where-Object is defined inside a script block, which is enclosed in curly braces { ... }.
Inside this script block, you use the special automatic variable $_ to refer to “the current object being processed”. In PowerShell 7 and newer, you can also use the more descriptive $PSItem.
To build the condition, you compare a property of the current object ($_.PropertyName) to a value using one of PowerShell’s comparison operators.
Common Comparison Operators
| Operator | Description | Example |
|---|---|---|
-eq | Equal to | $_.Status -eq 'Running' |
-ne | Not equal to | $_.Name -ne 'System' |
-gt | Greater than | $_.Length -gt 1MB |
-lt | Less than | $_.CPU -lt 10 |
-ge | Greater than or equal to | $_.Count -ge 5 |
-le | Less than or equal to | $_.WS -le 500MB |
-like | Wildcard comparison (*, ?) | $_.Name -like 'sql*' |
-match | Regular expression matching | $_.Name -match '^svc\d+' |
-not | Logical NOT (reverses a check) | -not ($_.Name -like 'System*') |
Common Usage
Filtering Files by Size
This example finds all files larger than 10 megabytes.
Get-ChildItem -File -Recurse | Where-Object { $_.Length -gt 10MB }Filtering for Running Services
This command gets all system services and filters for only those that are currently in the ‘Running’ state.
Get-Service | Where-Object { $_.Status -eq 'Running' }Filtering Processes Using Wildcards
This command finds all running processes whose names start with “sql”.
# Using the '?' alias for brevity
Get-Process | ? { $_.ProcessName -like "sql*" }Using Multiple Conditions
You can combine conditions using -and or -or. It’s a good practice to enclose each condition in parentheses () for clarity.
# Find svchost processes that are using more than 100MB of memory
Get-Process | where { ($_.ProcessName -eq "svchost") -and ($_.WS -gt 100MB) }