Group-Object

Group-Object [-AsHashTable] [-AsString] [[-Property] <Object[]>] [-CaseSensitive] [-Culture <string>] [-InputObject <psobject>] [-NoElement] [<CommonParameters>]

C:\PS>get-childitem *.doc | group-object -property length

This command gets the files in the current location that have a .doc extension and groups them by size.

C:\PS>get-childitem | sort-object -property extension | group-object -property extension

This command gets the files in the current location, sorts them by file name extension, and then groups them by file name extension. Note that the files are sorted before they are grouped.

C:\PS>1..35 | group-object -property {$_ % 2},{$_ % 3}

This example shows how to use script blocks as the value of the Property parameter. 

This command displays the integers from 1 to 35, grouped by the remainder left when they are divided by 2 or 3.

C:\PS>$events = get-eventlog -logname system -newest 1000 

C:\PS> $events | group-object -property eventID

Count Name                      Group
----- ----                      -----
   44 Information               {System.Diagnostics.EventLogEntry,
    5 Error                     {System.Diagnostics.EventLogEntry,
    1 Warning                   {System.Diagnostics.EventLogEntry}


Description
-----------
These commands display the 1,000 most recent entries in the System event log, grouped by Event ID. 

The first command uses the Get-EventLog cmdlet to retrieve the events and the assignment operator (=) to save them in the $events variable. 

The second command uses a pipeline operator (|) to send the events in the $events variable to the Group-Object cmdlet. The command uses the Property parameter to specify that the events should be grouped according to the value of their EventID property. 

In the output, the Count column represents the number of entries in each group, the Name column represents the EventID values that define a group, and the Group column represents the objects in each group.

C:\PS>get-process | group-object -property priorityclass

Count Name                Group
----- ----                -----
   55 Normal              {System.Diagnostics.Process (AdtAgent), System.Diagnostics.Process (alg), System.Dia...
    1                     {System.Diagnostics.Process (Idle)}
    3 High                {System.Diagnostics.Process (Newproc), System.Diagnostics.Process (winlogon), System.D... 
    2 BelowNormal         {System.Diagnostics.Process (winperf),  


C:\PS>get-process | group-object -property company -noelement
Count Name
----- ----
   55 Normal
    1
    3 High
    2 BelowNormal


Description
-----------
This example demonstrates the effect of the NoElement parameter. These commands group the processes on the computer by priority class.

The first command uses the Get-Process cmdlet to get the processes on the computer. It uses a pipeline operator (|) to send the results to Group-Object, which groups the objects by the value of the PriorityClass property of the process.

The second command is identical to the first, except that it uses the NoElement parameter to eliminate the members of the group from the output. The result is a table with only the count and property value name.

The results are shown in the following sample output.

C:\PS>get-eventlog -logname system -newest 1000 | group-object -property {$_.TimeWritten - $_.TimeGenerated}

This command demonstrates how to provide the value of the Property parameter as a script block.

This command displays the most recent 1,000 entries from the system event log, grouped according to the time between when they were generated and when they were written to the log. 

The command uses the Get-EventLog cmdlet to get the event log entries. It uses a pipeline operator (|) to send the entries to the Group-Object cmdlet. The value of the Property parameter is specified as a script block (an expression in braces). The result of evaluating the script block is the time between when the log entry was generated and when it was written to the log. That value is used to group the 1,000 most recent events.

C:\PS>get-childitem | group-object extension -noelement

Count Name
----- ----
   21
   82 .txt
    9 .cmd
    5 .log
   12 .xml
    5 .htm
   36 .ps1
    1 .psc1
    3 .exe
    6 .csv
    1 .psd1
    2 .bat


Description
-----------
This command groups the items in the current directory by file name extension. It uses the NoElement parameter to omit the members of the group.

The results are shown in the following sample output.

C:\PS>"a", "b", "c", "c", "d" | get-unique

a
b
c
d

C:\PS> "a", "b", "c", "c", "d" | group-object -noelement | where {$_.Count -gt 1}
Count Name
----- ----
    2 c

C:\PS> get-process | group-object -property Name -noelement | where {$_.count -gt 1}
Count Name
----- ----
    2 csrss
    5 svchost
    2 winlogon
    2 wmiprvse


Description
-----------
This example shows how to find the unique and non-unique (repeated) property values in a collection. 

The first command gets the unique elements of an array by piping the array to the Get-Unique cmdlet.

The second command gets the non-unique elements of an array. It pipes the array to the Group-Object cmdlet, which groups the objects by value. The resulting groups are piped to the Where-Object cmdlet, which selects objects with groups with more than one member.

The third command shows a practical use for this technique. It uses the same method to find processes on the computer that have the same process name.

The results are shown in the following sample output.

C:\PS>$a = get-command get-*, set-* -type cmdlet | group-object -property verb -ashashtable -asstring

C:\PS> $a 

Name    Value
----    -----
Get     {Get-PSCallStack, Get-PSBreakpoint, Get-PSDrive, Get-PSSession...}
Set     {Set-Service, Set-StrictMode, Set-PSDebug, Set-PSSessionConfiguration...}

C:\PS> $a.get

CommandType     Name                 Definition
-----------     ----                 ----------
Cmdlet          Get-PSCallStack      Get-PSCallStack [-Verbose] [-Debug] [-ErrorAction <ActionPrefer...
Cmdlet          Get-PSBreakpoint     Get-PSBreakpoint [[-Id] <Int32[]>] [-Verbose] [-Debug] [-ErrorA...
Cmdlet          Get-PSDrive          Get-PSDrive [[-Name] <String[]>] [-Scope <String>] [-PSProvider...
...


Description
-----------
This example uses the AsHashTable and AsString parameters to return the groups in a hash table, that is, as a collection of key-value pairs. 

In the resulting hash table, each property value is a key, and the group elements are the values. Because each key is a property of the hash table object, you can use dot notation to display the values.

The first command gets the Get and Set cmdlets in the session, groups them by verb, returns the groups as a hash table, and saves the hash table in the $a variable. 

The second command displays the hash table in $a. There are two key-value pairs, one for the Get cmdlets and one for the Set cmdlets.

The third command uses dot notation to display the values of the Get key in $a. The values are CmdletInfo object. The AsString parameter does not convert the objects in the groups to strings.