title: Powershell, -filterhashtable, and operators
body: <p>I'm filtering event log entries using the "Get-Winevent" cmdlet. I want to get events whose levels are less than 4 (or where LevelName isn't "Informational"). </p>
  
  <p>I use the -filterhashtable flag to filter the events. But is there a way to do comparisons with filterhashtable? Or just put a "not"? Or does filterhashtable only accept "=" as an operator?</p>
  
  <p>These two snippets work and get the same results:</p>
  
  <p>where-object </p>
  
  <pre><code>$events = Get-WinEvent -computer ServerName -LogName System | Where-Object {$_.level -lt 4}
  </code></pre>
  
  <p>-filterhashtable</p>
  
  <pre><code>$events = Get-WinEvent -computer ServerName -FilterHashTable @{LogName = 'System'; Level = 1}
  $events += Get-WinEvent -computer ServerName -FilterHashTable @{LogName = 'System'; Level = 2}
  $events += Get-WinEvent -computer ServerName -FilterHashTable @{LogName = 'System'; Level = 3}
  </code></pre>
  
  <p>The second snippet runs much faster than the first snippet (2 minutes versus 16 seconds in one case). As I understand it, "where-object" has to wait until "Get-WinEvent" has gotten every event object (possibly thousands). Adding "-filterhashtable" causes the target system's event log to filter before it gives the event object ot Get-WinEvent, which is much faster.</p>
  
  <p>Can I combine the statements? These snippets don't work:</p>
  
  <pre><code>$events = Get-WinEvent -computer ServerName -FilterHashTable @{LogName = 'System'; Level &lt; 4}
  $events = Get-WinEvent -computer ServerName -FilterHashTable @{LogName = 'System'; Level != 2}
  </code></pre>
  
  <p>The "Level" properties is type "int[32]" so a comparison operator should work. In fact, it does work with "where-object". But it doesn't work with the "-filterhashtable" flag. Is there no way to do that sort of comparison? Is "=" the only operator -filterhashtable accepts?</p>