CmdID / PowerShell / Cmdlets / Select
Select-Object
Selects objects or object properties. PowerShell reference
From the PowerShell reference
11 parameters
Alias select
What it does
Selects objects or object properties. The Select-Object cmdlet selects specified properties of an object or set of objects. It can also select unique objects, a specified number of objects, or objects in a specified position in an array. To select objects from a collection, use the First, Last, Unique, Skip, and Index parameters. To select object properties, use the Property parameter. When you select properties, Select-Object returns new objects that have only the specified properties. Beginning in Windows PowerShell 3.0, Select-Object includes an optimization feature that prevents commands from creating and processing objects that aren't used. When you use Select-Object with the First or Index parameters in a command pipeline, PowerShell stops the command that generates the objects as soon as the selected number of objects is reached. To turn off this optimizing behavior, use the Wait parameter.
Select-Object [[-Property] <Object[]>] [-InputObject <psobject>] [-ExcludeProperty <string[]>] [-ExpandProperty <string>] [-Unique] [-Last <int>] [-First <int>] [-Skip <int>] [-Wait] [<CommonParameters>]Select-Object [[-Property] <Object[]>] [-InputObject <psobject>] [-ExcludeProperty <string[]>] [-ExpandProperty <string>] [-Unique] [-SkipLast <int>] [<CommonParameters>]Select-Object [-InputObject <psobject>] [-Unique] [-Wait] [-Index <int[]>] [<CommonParameters>]
Select objects by property
Get-Process | Select-Object -Property ProcessName, Id, WSIdentifySelect objects by property and format the results
Get-Process Explorer |
Select-Object -Property ProcessName -ExpandProperty Modules |
Format-ListIdentifySelect processes using the most memory
Get-Process | Sort-Object -Property WS | Select-Object -Last 5IdentifySelect unique characters from an array
"a","b","c","a","a","a" | Select-Object -UniqueIdentifyUsing -Unique with other parameters
"a","a","b","c" | Select-Object -First 2 -UniqueIdentifySelect newest and oldest events in the event log
$a = Get-EventLog -LogName "Windows PowerShell"
$a | Select-Object -Index 0, ($A.Count - 1)IdentifyTrips 2 Sigma rules: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems); mediumPotentially Suspicious EventLog Recon Activity Using Log Query Utilities by Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Select all but the first object
New-PSSession -ComputerName (Get-Content Servers.txt | Select-Object -Skip 1)IdentifyRename files and select several to review
Get-ChildItem *.txt -ReadOnly |
Rename-Item -NewName {$_.BaseName + "-ro.txt"} -PassThru |
Select-Object -First 5 -WaitIdentifyShow the intricacies of the -ExpandProperty parameter
# Create a custom object to use for the Select-Object example.
$object = [pscustomobject]@{Name="CustomObject";List=@(1,2,3,4,5)}
# Use the ExpandProperty parameter to Expand the property.
$object | Select-Object -ExpandProperty List -Property NameIdentifyCreate custom properties on objects
$customObject = 1 | Select-Object -Property MyCustomProperty
$customObject.MyCustomProperty = "New Custom Property"
$customObjectIdentifyIts page in the reference: Select-Object.
Parameters
-ExcludePropertySpecifies the properties that this cmdlet excludes from the operation. Wildcards are permitted. This parameter is effective only when the command also includes the Property parameter.-ExpandPropertySpecifies a property to select, and indicates that an attempt should be made to expand that property. If the input object pipeline doesn't have the property named, Select-Object returns an error. This parameter supports wildcards. However, the wildcard character must resolve to a single property name. If the wildcard character resolves to more than one property name, Select-Object returns an error.
When you use ExpandProperty, Select-Object attempts to expand the specified property for every object in the pipeline.
- If the specified property is an array, each value of the array is included in the output.
- If the specified property is an object, the objects properties are expanded for every
InputObject
In either case, the output objects' Type matches the expanded property's Type. There is a
side-effect when using ExpandProperty. The Select-Object adds the selected properties to the
original object as NoteProperty members.
If the Property parameter is specified, Select-Object attempts to add each selected property as a NoteProperty to every outputted object.
WARNING:
If you receive an error that a property can't be processed because a property with that name …-FirstSpecifies the number of objects to select from the beginning of a collection of input objects. When you use this parameter with the Skip parameter, Select-Object selects the first number of objects after skipping the number of objects specified by Skip.-IndexSelects objects from an array based on their index values. Enter the indexes in a comma-separated list. Indexes in an array begin with 0, where 0 represents the first value and (n-1) represents the last value.-InputObjectSpecifies objects to send to the cmdlet through the pipeline. This parameter enables you to pipe objects to Select-Object.
When you pass objects to the InputObject parameter, instead of using the pipeline,
Select-Object treats the InputObject as a single object, even if the value is a collection. It
is recommended that you use the pipeline when passing collections to Select-Object.-LastSpecifies the number of objects to select from the end of a collection of input objects. If the command uses the Skip parameter it skips items from the end of the collection, then returns the last number of objects specified by the Last parameter after skipping. If you use the Skip parameter with both First and Last, Select-Object skips objects from the beginning.-PropertySpecifies the properties to select. These properties are added as NoteProperty members to the output objects. Wildcards are permitted. If the input object doesn't have the property named, the value of the new NoteProperty is set to $null.
The value of the Property parameter can be a new calculated property. To create a calculated, property, use a hash table.
Valid keys are:
- Name (or Label) - <string>
- Expression - <string> or <scriptblock>
For more information, see about_Calculated_Properties.-SkipSkips (doesn't select) the specified number of items. By default, the Skip parameter counts from the beginning of the collection of objects. Unlike the Index parameter, which starts counting at 0, the Skip parameter begins at 1.
When you use this parameter with the First parameter, Select-Object selects the first number of objects after skipping the number of objects specified by Skip.
If the command uses the Last parameter it skips items from the end of the collection, then returns the last number of objects specified by the Last parameter after skipping.
If you use both the First and Last parameters, Select-Object skips objects from the beginning. If you also want to skip objects from the end, use the SkipLast parameter.-SkipLastSkips (doesn't select) the specified number of items from the end of the list or array. Works in the same way as using Skip together with Last parameter.
Unlike the Index parameter, which starts counting at 0, the SkipLast parameter begins at 1.-UniqueSpecifies that if a subset of the input objects has identical properties and values, only a single member of the subset should be selected.
Unique selects values _after_ other filtering parameters are applied.
This parameter is case-sensitive. As a result, strings that differ only in character casing are considered to be unique.-WaitIndicates that the cmdlet turns off optimization. PowerShell runs commands in the order that they
appear in the command pipeline and lets them generate all objects. By default, if you include a
Select-Object command with the First or Index parameters in a command pipeline, PowerShell
stops the command that generates the objects as soon as the selected number of objects is generated.
This parameter was introduced in Windows PowerShell 3.0.