Search code examples
powershellfilterget-ciminstance

Or clause in Get-CimInstance filter


This should be simple but I just haven't been able to figure it out. How to I implement an or clause with a Get-CimInstance filter? I'm filling an XAML listview with processes and I only want to return powershell, powershell_ise or pwsh but I can't figure out how to do an -or clause properly. I've tried:

Get-CimInstance -ClassName Win32_Process -Filter "Name like 'Powershell%'" -or "Name like 'pwsh%'" 

Get-CimInstance -ClassName Win32_Process -Filter ("Name like 'Powershell%'") -or "(Name like 'pwsh%'")

but these don't work. I get "Get-CimInstance : A parameter cannot be found that matches parameter name 'or'."

I would think this would be easier than this.


Solution

  • Take out the dash in "or". The syntax is like "where" in sql. Also it should be one long quote.

    Get-CimInstance Win32_Process -Filter "name like 'powershell%' or 
      name like 'pwsh%'" 
    
    ProcessId Name           HandleCount WorkingSetSize VirtualSize
    --------- ----           ----------- -------------- -----------
    6056      powershell.exe 774         47206400       2204070068224
    

    Note that the commandline property is useful compared to powershell 5.1's get-process:

    Get-CimInstance Win32_Process -filter 'name = "chrome.exe"' | select commandline
    
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --origin-trial-disabled-features=ElementCapture --restart --restart
    

    Adding commandline to powershell 5.1's get-process:

    # add commandline property to get-process like powershell 7
    $updateTypeData = @{
        TypeName   = 'System.Diagnostics.Process'
        MemberName = 'CommandLine'
        MemberType = [Management.Automation.PSMemberTypes]::ScriptProperty
        Force      = $true
        Value      = { (Get-CimInstance Win32_Process -Filter "ProcessId = 
                       $($this.Id)").CommandLine }
    }
    Update-TypeData @updateTypeData
    

    Query with wmic for extra awkwardness:

    wmic process where 'name like "powershell%" or name like "pwsh%"'