PowerShell Select weirdness PowerShell Select weirdness powershell powershell

PowerShell Select weirdness


Looks like a formatting issue, the following seems to work as expected though:

$before = get-date$after = (get-date).AddDays(-1)$a = Get-EventLog System -Before $before -After $after | ? {$_.Message -like "*start*"}$a | select message, username,timegenerated | format-table -forceecho "----going through security----" $b = Get-Eventlog security -Before $before -After $after |?{$_.category -match "Logon/Logoff" } $b | select username,timegenerated | format-table -force

Additionally, this definitely looks like a bug concerning the output of multiple custom psobjects (created above as a result of doing the selects).

The following code explicitly creates a separate PSObject for each query result and returns the same results as your code (i.e. only one set of headings):

$before = get-date$after = (get-date).AddDays(-1)$a = Get-EventLog System -Before $before -After $after | ? {$_.Message -like "*start*"}$a = $a | `    % {New-Object PSObject -Property `        @{Message = $_.message; Username = $_.username; Timegenerated = $_.timegenerated}    }$aecho "----going through security----" $b = Get-Eventlog security -Before $before -After $after |?{$_.category -match "Logon/Logoff" } $b = $b | `    % {New-Object PSObject -Property `        @{Username = $_.username; Timegenerated = $_.timegenerated}    }$b

Run this in PS_ISE and execute:

$a | gm$b | gm

You can see that they are distinct objects with different properties. Things get even weirder if you don't use the same key names between objects; look at the results returned if we change:

$b = $b | `    % {New-Object PSObject -Property `        @{Username = $_.username; Timegenerated = $_.timegenerated}    }

to:

$b = $b | `    % {New-Object PSObject -Property `        @{UsernameB = $_.username; TimegeneratedB = $_.timegenerated}    }

For those with no will to run this, it returns whitespace where the security result set should be. Running Get-Member again shows two custom objects, each with it's own properties.

It's probably worth logging this with Microsoft Connect although it looks like PSCustomObjects might be getting an overhaul in v3, see here.


This is a function of PowerShell's console output. When you output the first set of objects, you set the format for all subsequent objects. Everything following will be presented as a continuous stream of objects within the same table and publishing the same properties.

If you emit $a in one run and $b in a completely different run, you'll see you've really got two distinct sets of objects. You're just seeing a console formatting issue here.