Skip to content

Add support <Suppress> in Get-WinEvent -FilterHashtable  #2402

Description

@iSazonov

Now Get-WinEvent -FilterHashtable support only Select for query.
Although Windows Event Log supports a subset of XPath 1.0 including Suppress.
An example of such a query:
query

I see three ways to add new functionality:

  1. Add new parameter FilterHashtableSuppress or SuppressFilterHashtable.
  2. Use prefix for standard keys: SUPId, SUPLevel, SUPUserID, SUPStartTime, SUPEndTime, SUPData, SUPNamedKey. Ex.:
    Get-WinEvent -FilterHashtable @{Logname="Application";SUPId=1001}

3.Use special 'SuppressHashFilter' property in hash table.
Ex.:
Get-WinEvent -FilterHashtable @{Logname="Application";Id=1001;SuppressHashFilter=@{Id=1002}}

Metadata

Metadata

Assignees

Labels

Issue-Enhancementthe issue is more of a feature request than a bugResolution-FixedThe issue is fixed.WG-Cmdletsgeneral cmdlet issues

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions