WEBVTT 00:00.600 --> 00:07.650 Rent Syntec software object it uses a filtered script within that script you can use the built in Dolor 00:07.650 --> 00:08.340 character. 00:08.340 --> 00:16.170 P.S. item wearable or Dora Dolor character underscore which is also well it in earlier versions of Windows 00:16.170 --> 00:16.960 parsha. 00:17.070 --> 00:23.270 So you use them to reference whatever objects so well that in earlier versions of Windows Berisha. 00:23.310 --> 00:28.380 So you use them to reference whatever object was piped into the command. 00:28.530 --> 00:35.900 Your filtered script real executive one time of each object that is piped into like that command running 00:35.910 --> 00:38.090 a filter rescript returns true. 00:38.220 --> 00:43.660 That object is passed down their partners out to run your filter script returns false. 00:43.770 --> 00:49.630 That object is removed from the pipeline for two commands are functionally identical. 00:49.650 --> 00:52.720 The first use of the basic semantics and the second to you. 00:52.850 --> 01:00.840 And when syntax to do the same same got service pipe where a state is equal around in and does equal 01:00.840 --> 01:09.420 the in and get service by their object filter script and the condition for this for each item which 01:09.440 --> 01:13.100 is BSI item wearable Dodes status. 01:13.170 --> 01:19.830 So when we take the status of each item and compare it to Iran instead. 01:19.860 --> 01:24.100 So parameter is positional and most users will admit it. 01:24.210 --> 01:33.130 Most users will also use the where else or even the stronger questionmark less experienced Windows partial 01:33.210 --> 01:40.530 users will also use their duller character undiscoverable instead of Dolor character previous that of 01:40.740 --> 01:47.370 the lower character previous item because only the player character on the score was allowed to in version 01:47.370 --> 01:49.360 1 and 2 of the show. 01:49.470 --> 01:54.270 Most of the following commands performed the same task as the previous two commands. 01:54.300 --> 02:03.270 The first one is longer where we use where and item wearable well and in the second gets they get serviced 02:03.510 --> 02:05.500 by Dolor correct. 02:05.520 --> 02:06.180 Sorry. 02:06.240 --> 02:14.110 QUESTION Mark character and dealer character underscore instead of beside him the quotation marks around 02:14.130 --> 02:14.900 running. 02:15.000 --> 02:18.540 Is this in these examples are required. 02:18.660 --> 02:24.330 Otherwise Lachelle village called in which would fail because no such command exists. 02:24.330 --> 02:26.650 Some votes about multiple criteria. 02:26.700 --> 02:34.830 The advanced syntax enables you to specify multiple criteria by Yulian there and and or Bhuiyan or larger 02:34.830 --> 02:41.000 collaborators for example get him and lock log name security maturity. 02:41.110 --> 02:51.630 You asked one Kondrat pipe it to where we are Suydam that event ID is equal to 5:56 1:53 and they are 02:51.630 --> 02:55.270 sayat him Daut and treat type as equal to success. 02:55.280 --> 03:02.480 How did the logical operator must have a complete comparison on RASM on either side of it. 03:02.480 --> 03:09.210 Ellis example the first comparison checked their Went ID property and the second comparison check the 03:09.270 --> 03:10.690 entry type robot. 03:10.800 --> 03:15.390 The following example is one of that many begin end user strike. 03:15.540 --> 03:18.840 It's incorrect because the second comparison is incomplete. 03:18.840 --> 03:19.980 So let's review it. 03:20.060 --> 03:27.690 Got C.P. you greater than Sauti and virtual memory or V.M. less than 10000. 03:27.690 --> 03:31.760 The problem here is that the game has no meaning. 03:31.980 --> 03:35.250 Item variable dot we would be correct. 03:35.400 --> 03:42.710 Here is another common mistake get serviced by where we are side ASPI where aside from that state is 03:42.770 --> 03:45.540 equal to running or starting. 03:45.540 --> 03:50.460 The problem is that example is that starting is not a complete comparison. 03:50.520 --> 03:51.710 It is just a screen. 03:51.720 --> 04:00.150 Well you are Suydam dot status equals to start him would be the correct syntax was intended to resolved. 04:00.150 --> 04:06.520 Remember that the only purpose of the filter script is to produce a true or false value. 04:06.540 --> 04:12.780 Usually you'll produce those values by use in a comparison operator and in the examples that you have 04:12.780 --> 04:14.660 seen to this point. 04:14.670 --> 04:21.330 However when a property already contains either true or false you do not have to listen for example 04:21.340 --> 04:26.540 that objects produced by God plosives have a property named respondent. 04:26.670 --> 04:29.630 This property contains either true or false. 04:29.640 --> 04:36.030 This indicates whether the process represented by the object is currently respondent to the operating 04:36.030 --> 04:41.500 system to obtain a list of processes that are respondent that are respondent. 04:41.610 --> 04:44.580 You could use either of the following commands. 04:44.640 --> 04:50.440 Got Brosius by where are side and don't respond in equal to dollar character. 04:50.440 --> 04:57.900 True or got bruises pipe where people cite him don't respond in the first command of the special shell 04:57.900 --> 04:58.500 variable. 04:58.510 --> 05:01.360 True is used to well you're through. 05:01.440 --> 05:04.530 The second example there is no comparison at all. 05:04.530 --> 05:10.520 The second example is because the respondent property already contains draw false. 05:10.550 --> 05:16.770 Reversing the logic to list only processes that are not respondent looks similar. 05:16.800 --> 05:24.240 You could try get Prosser's pipe where aside from got respondent in this example that not a logical 05:24.240 --> 05:27.160 operator changes true to false. 05:27.180 --> 05:29.300 And change is false to true. 05:29.430 --> 05:35.080 Therefore you reproducers is not respond in its respondent property would be false. 05:35.100 --> 05:42.180 The not operator changes that to true which causes the process to be a process to be generated into 05:42.180 --> 05:46.570 the pipeline and included in the final output of the command. 05:46.590 --> 05:53.460 Although the basic filtering syntax can access only direct properties of the object being evaluated. 05:53.460 --> 05:56.700 The Edwyn syntax does not have that limitation. 05:56.790 --> 06:03.290 For example to display a list of all services that had AIM's longer than 8 characters you've got to 06:03.300 --> 06:10.890 use this good service pipe where the outside don't name dot Lange's greater than 8. 06:10.890 --> 06:13.910 Now let's get a look at some practice examples here. 06:13.920 --> 06:20.520 You'll see various ways to filter objects out of the pipeline like filter using the basic syntax advanced 06:20.520 --> 06:24.170 in text and filter using multiple criteria. 06:24.240 --> 06:31.980 So to use basic filter and syntax to display a list of SMB shares that include a dollar sign in their 06:31.980 --> 06:32.940 shared name. 06:32.940 --> 06:34.570 You could use the following command. 06:34.680 --> 06:44.630 Get SMB share by where a name like Daler character like Daler character in asterisks and in quotes to 06:44.630 --> 06:50.600 use Advance filter and syntax to display a list of physical disks that are in healthy condition. 06:50.610 --> 06:52.400 You could type the following command. 06:52.440 --> 07:00.900 Get physical disk by their object filtered script aside from got health status equal to house risk Williams 07:01.170 --> 07:08.420 that are fixed disks and that to you the NTFS file system you could type got William pipe where they 07:08.430 --> 07:10.110 are solid and type. 07:10.140 --> 07:20.360 Dr sorry Dr type is equal to fixed and operator Psilotum dirt filter system equal NTFS and quotes. 07:20.460 --> 07:27.910 And the final example is to use Advance filter and since Syntec sound without you the Lapeer site wearable 07:28.080 --> 07:34.240 we could display a list of windows powers shall command verbs that contain so Rillette beginning with 07:34.240 --> 07:43.860 a C letter to do that we could Taieb get ror by where Dolor character underscore dot verb like C asterisk 07:43.950 --> 07:51.000 in quotes so that will display a list of all the command twirps that begins with the letter and some 07:51.000 --> 07:53.930 Virts about optimize unfilter in performance. 07:53.940 --> 08:00.320 You can have a significant effect on performance performance based on how you write your commands and 08:00.330 --> 08:03.870 that you are given a container of plastic blocks. 08:03.960 --> 08:07.350 Each block is one of the following colors red green or blue. 08:07.350 --> 08:10.660 Each block has a letter of alphabetical printed on it. 08:10.680 --> 08:14.450 You are RASC to put all the red blocks in alphabetical order. 08:14.580 --> 08:15.900 What would you do first. 08:16.020 --> 08:22.750 Consider writing this task and the power shall command by using the command by using the fictional get 08:22.770 --> 08:23.820 block command. 08:23.820 --> 08:27.140 Which of the following two examples do I think will be faster. 08:27.150 --> 08:31.120 The first one got block by sort object property. 08:31.160 --> 08:36.430 Latter why were object filter's script aside that what. 08:36.480 --> 08:44.390 Equal read and the second example will be got block their object filter's script or side dodge caller. 08:44.520 --> 08:48.580 Equal read by Sorto object property letter. 08:48.690 --> 08:53.550 The second command would be faster because it removes unwanted blocks from the pipeline. 08:53.670 --> 08:58.470 The first command saw with all the blocks and then removes many of them. 08:58.470 --> 09:01.230 This means that much of the so was wasted. 09:01.230 --> 09:06.880 There is a mnemonic used by many POAs shell users to help them remember to do this. 09:06.930 --> 09:10.230 The correct scene when they are up to margin performance. 09:10.230 --> 09:15.600 The racist filter left and it means that any filtering should occur. 09:15.600 --> 09:22.110 You're as far to the left or as close to the beginning of the code to the beginning of the command line 09:22.200 --> 09:23.250 as possible. 09:23.250 --> 09:25.870 So first the filter then your sort. 09:25.950 --> 09:32.790 Try to do filter as closer to the beginning as possible sometimes move in filter and as far to the left 09:33.060 --> 09:36.460 as possible means that you will know to use where object. 09:36.510 --> 09:43.350 For example the girl child item command can produce a list the list of objects that include files and 09:43.350 --> 09:44.130 folders. 09:44.220 --> 09:50.250 Each object produced by the command has a property named as its container it contains. 09:50.280 --> 09:54.910 It contains true if the object represents a folder and false. 09:54.930 --> 10:01.290 If the object represents a file the following command will produce a list that an child might imply 10:01.660 --> 10:06.330 or not operator beside him that P.S. Is container. 10:06.330 --> 10:12.720 However that is not the most efficient way to produce the result the get child item command has a parameter 10:12.720 --> 10:15.300 that limits the commands output. 10:15.300 --> 10:23.070 So we could type girl child diatom desk file that'd be more more efficient way to produce the result 10:23.310 --> 10:24.360 when it is possible. 10:24.360 --> 10:31.230 Check the help files for the commands that you use to see whether they contain a parameter that can 10:31.230 --> 10:33.300 do the filter and you want. 10:33.300 --> 10:34.740 Here is another example. 10:34.770 --> 10:42.930 Get service type where a name like operator as we see greater as we see asterisk. 10:42.930 --> 10:49.100 This is the most efficient way to produce a list of services whose names start with as.