WEBVTT 00:00.400 --> 00:04.820 Some partial commands produce their output in a specific order. 00:04.860 --> 00:09.020 For example both good process and good service produce sound good. 00:09.120 --> 00:11.600 That is sorted alphabetically by name. 00:11.620 --> 00:14.680 Get a grant like produces output sorted by time. 00:14.700 --> 00:18.200 Sometimes you might want command output sorted differently. 00:18.300 --> 00:23.310 The sort object Command which has the LS sort can do that for you. 00:23.310 --> 00:27.550 The command accepts one or more properties names to sort on. 00:27.600 --> 00:30.330 By default the command starts in ascending order. 00:30.420 --> 00:35.360 If you want to reverse this sort order at the does descendant parameter. 00:35.370 --> 00:41.310 If you specify more than one property the command sorts on the first property first and then on the 00:41.310 --> 00:43.260 second property and so on. 00:43.290 --> 00:50.130 It is not possible in a single command to sort on the one property in ascending order and neither in 00:50.130 --> 00:51.270 descending order. 00:51.270 --> 00:56.860 For example Gazzara service pipes sort object property name descendant. 00:57.000 --> 01:02.270 Or another example is Gazzara was sort of name the details. 01:02.310 --> 01:05.520 See also an abbreviation for the Sanden. 01:05.520 --> 01:07.970 You can shorten the parameters. 01:08.010 --> 01:15.150 Or another example is good service sort answered by stators and then name by default string properties 01:15.150 --> 01:17.510 of sorted without regard to case. 01:17.520 --> 01:22.930 In other words lower case and upper case letters are treated the same parameter. 01:22.940 --> 01:31.080 So for sort objects enable you to specify a case sensitive sort of specific cultures certain rules and 01:31.080 --> 01:32.100 other options. 01:32.100 --> 01:33.870 Now let's have some practice. 01:33.870 --> 01:41.250 Use an got member command will sort object unproper to sort of multiple properties and specifies certain 01:41.250 --> 01:48.320 options so to display a list of processes sorted by Breau society we could run get grossers pipe sort 01:48.330 --> 01:56.430 object does property ID so read thought in it by id property to display a list of services sorted by 01:56.430 --> 02:03.480 stators we could run the following command to service what sort object property state has to display 02:03.480 --> 02:10.160 a list of the most recent 10 security around Low Countries sorted with the oldest entry first. 02:10.200 --> 02:11.950 We can run the following command. 02:12.000 --> 02:13.160 Got the wrong clock. 02:13.260 --> 02:19.810 The log name security in us can pipe it to sort object and sorted by property time written. 02:19.920 --> 02:26.370 No that stopped appears before Ron and because the property is stored as a number internally with zero 02:26.370 --> 02:28.800 stopped coming before one run. 02:28.800 --> 02:34.380 Another example is to display a list of services sorted first by stators then by name. 02:34.380 --> 02:42.550 We could run Gazzara Spybot to insert object and sorted by property name and status separated as karma. 02:42.660 --> 02:48.950 What about measuring objects the mother or adject command can accept any kind of object in a collection. 02:48.990 --> 02:55.110 By default the command counts the number of four objects in the collection and produces a measurement 02:55.380 --> 02:58.320 object that includes the called the command. 02:58.360 --> 03:05.670 The s measure latish property parameter of my other object enables you to specify a single property 03:05.910 --> 03:08.550 that must contain numeric values. 03:08.550 --> 03:10.770 You can then include the dash. 03:10.810 --> 03:17.730 PS. does ever issue this minimum and maximum parameters to calculate those aggregate. 03:17.730 --> 03:23.940 Well yes for the specified property please know that because Windows for Shell enables you to truncate 03:23.940 --> 03:29.110 parameter names you can frequently see those returns says PS.. 03:29.260 --> 03:34.780 This mean this Max corespondent to common English abbreviations for those Rourke's. 03:34.800 --> 03:43.740 However Desch average can not be shorted to does a Viji although beginning users frequently try the 03:43.740 --> 03:47.510 parameter could be shortened to dash avi. 03:47.550 --> 03:50.900 Because that is a legal truncation for them. 03:50.940 --> 03:57.940 So please remember not that ADG but there's a V E is the truncation for average. 03:58.050 --> 04:00.050 Now let's have some practice. 04:00.210 --> 04:04.760 Measure object command let's count objects and calculate aggregate. 04:04.770 --> 04:05.420 Well yes. 04:05.490 --> 04:12.030 So to display the number of services on your computer we could run get service pyper to measure objects 04:12.150 --> 04:18.540 to display the number of running processes we could run get processed and pipe it to measure object 04:18.720 --> 04:21.080 and to display the total number. 04:21.180 --> 04:26.470 Total amount and average amount of virtual memory being used by processors. 04:26.550 --> 04:28.210 We could run the following command. 04:28.350 --> 04:30.870 Got closer Spybot to measure object. 04:30.930 --> 04:37.500 Thus property VM Desam does average or does every small one. 04:37.590 --> 04:42.190 Sometimes you may not need to display all the objects produced by a command. 04:42.270 --> 04:48.770 For example you have already seen how they get their Schrank lock command can produce a list of owners 04:48.770 --> 04:50.740 in the US and lock Antrix. 04:50.790 --> 04:55.290 Not all commands have the built in ability to limit their output like that. 04:55.290 --> 05:02.080 However the select does object command can do this for Rannoch amounts output and of course Command 05:02.080 --> 05:09.880 has a Neleus it is select select object can perform two separate tasks in one command select in a subset 05:09.880 --> 05:11.980 of objects is just one of them. 05:12.070 --> 05:19.420 If you think of a collection of objects as a table or spreadsheet select a subset means selecting just 05:19.420 --> 05:26.200 certain roles with select objects you cannot specify a criteria to decide which role will be selected. 05:26.200 --> 05:32.470 Instead you can select only a specific number of rows from the beginning or end of the collection. 05:32.470 --> 05:38.260 You can also specify that a certain number of rows be skipped before the selection begins. 05:38.260 --> 05:39.910 Let's review several examples. 05:39.910 --> 05:46.180 To select the fields and processes based on lowest virtual memory use we could run the following command 05:46.410 --> 05:53.170 get processed by sort object property by select object first. 05:53.260 --> 05:57.580 Another example is to select the last and run and service is sorted by name. 05:57.640 --> 06:05.710 To do that we could run get service 5 to sort object property name and pipe it to select object last 06:05.800 --> 06:06.460 time. 06:06.460 --> 06:13.420 Another example is to select five processes using the least amount of spew but skipping the one process 06:13.420 --> 06:21.280 using the least Sibiu to do that we could run get pro-ISIS by to sort of object property Sibiu descended 06:21.510 --> 06:25.490 by bit to select object first five and skip 1. 06:25.530 --> 06:31.060 Now if you want to select properties of objects in addition to selecting the first or last number of 06:31.060 --> 06:36.470 rows from a collection you can use select object to select specified properties. 06:36.550 --> 06:40.720 If you think of a collection of object as a table or a spreadsheet you can. 06:40.840 --> 06:44.440 You can choose the specified properties to display. 06:44.530 --> 06:50.710 So you are choosing the columns to display after you choose the properties you want select object will 06:50.710 --> 06:52.530 remove all other properties. 06:52.600 --> 06:59.620 For example if you want to sort in a particular property but not display it you must use sort object 06:59.620 --> 07:05.110 first and then select object to specify the properties that you want to display. 07:05.110 --> 07:11.500 Use caution when specifying property names sometimes the default screen display created by Windows for 07:11.500 --> 07:16.580 itself does not use real property name in table column collimate headers. 07:16.600 --> 07:21.480 For example the output of get groceries includes a corn labeled soupy use. 07:21.490 --> 07:29.800 However the system got diagnostics that process object type does not have a property that has the name 07:30.010 --> 07:32.340 the actual property name is CPQ. 07:32.440 --> 07:38.550 You can see this by piping the output of get plosives to get mamber as a best practice. 07:38.580 --> 07:45.010 Always review proper names in the output of get mamber before you use those property names in another 07:45.040 --> 07:45.730 command. 07:45.730 --> 07:52.290 Doing This guarantees that you are using the actual property name and not a made up name created to 07:52.510 --> 07:53.930 for display purposes. 07:54.010 --> 07:56.130 Now let's review several examples. 07:56.170 --> 08:02.700 If you wanted to specify the properties to display record you use property parameter of select object. 08:02.770 --> 08:10.720 For example get processed by a to select object property name ID the AM PM MCP you. 08:10.840 --> 08:16.320 Another example if you want to combine that parameter with Foster last you could use the following command 08:16.330 --> 08:23.990 get processed by apatosaurus object sorted by property V.M. in descending order and then Pypard to select 08:24.010 --> 08:26.150 object by property name. 08:26.190 --> 08:30.940 VM does first term so it'll show us frustum objects. 08:31.000 --> 08:37.060 Please know that the output of that command might look odd but by default Windows partial tries to feel 08:37.060 --> 08:39.310 that it's your console window. 08:39.310 --> 08:45.850 By spreading out table Colon's when you display only some Colon's the resulting output contains a large 08:45.850 --> 08:48.610 amount of space in between the columns. 08:48.610 --> 08:52.940 You can also specify a wildcard barter for a property name. 08:53.020 --> 08:59.710 Also if that results in lots of properties being selected some of those properties might be truncated 08:59.710 --> 09:04.710 because of screen space for example got processed by a 2 select object. 09:04.750 --> 09:06.760 Thus property asterisk. 09:06.760 --> 09:13.660 Now let's practice a bit with the various ways to use Select object will select subsets of collection 09:13.900 --> 09:15.880 and select specific properties. 09:15.880 --> 09:22.120 The first example is to display the Ten largest processes by virtual memory use to do that. 09:22.120 --> 09:23.410 We can run the following command. 09:23.410 --> 09:31.540 Get closest piped to sort object by property VM and in descending order then pipe it to select object 09:31.780 --> 09:33.080 and so forth. 09:33.220 --> 09:38.800 Another example is to display the current day of week for example Monday or Tuesday to do that. 09:38.800 --> 09:46.480 We could run get date by to select object does propertied day of week and so the example is to display 09:46.480 --> 09:49.710 the Ten Most recent security event log. 09:49.750 --> 09:55.780 And this will include showing where they went I did time return and wound message to do that we could 09:55.780 --> 10:03.430 type event log Desch New-Year's turned us Lagny security and pipe it to select object does property 10:03.480 --> 10:05.830 well-tended time written on message.