Simplify PowerShell Output With the Expression CommandSimplify PowerShell Output With the Expression Command

One PowerShell command I use with increasing frequency is the Expression command. Technically, it creates a calculated property. However, in practical terms, it makes it much easier to customize PowerShell's output to display precisely what you want.

The Problem: Extracting Process Names From TCP Connections

Here's an example: I set up several Hyper-V virtual machines to run a distributed application a few weeks ago. While doing so, I ran into networking problems related to a configuration error I had made. Troubleshooting involved using several different PowerShell cmdlets, but one of the most useful was Get-NetTCPConnection.

For those unfamiliar with Get-NetTCPConnection, it provides detailed information about a system's TCP connections. In my case, I needed to identify which process was using a given port to troubleshoot a connectivity issue.

I bring up this situation because while Get-NetTCPConnection can show you which process is using a given port number, it only displays the process ID (PID)—which, on its own, isn't very helpful. Yes, the PID corresponds to a specific process, but it's difficult to determine the process without knowing its name. Herein lies the problem: PowerShell does allow you to look up a process name based on a PID, but you need a separate command (Get-Process).

Related:Test-NetConnection Cmdlet: A PowerShell-Based Ping Alternative

Now, imagine you want to generate a list of local ports with the processes using them. Using conventional PowerShell scripting techniques, you would typically: 

In short, while this method works, it requires quite a bit of effort. 

Simplifying With the Expression Command

This is where the Expression command simplifies things. You can accomplish the same task in a single line of code! Here's an example:

Get-NetTCPConnection | Select-Object LocalPort, OwningProcess, @{Name="ProcessName";Expression={(Get-Process -ID $_.OwningProcess).ProcessName}}

You can see what this looks like in Figure 1.

Figure 1. The command returns the information we need.

As shown in Figure 1, this command returns three key pieces of information:  

Let's look at what the command is doing.

Breaking Down What the Command Does

The first part is straightforward:

Related:How I Built My Own PowerShell Multi-File Search Tool

Just after referencing the OwningProcess, @(Name="ProcessName" tells PowerShell to add a ProcessName column to the output. Since Get-NetTCPConenction doesn't return process names, we need to calculate it ourselves. 

The Expression command comes in now.

Put simply, the Expression command acts as a bridge for passing a value to an unrelated command, retrieving a result, and displaying that result as a custom property in PowerShell's output.

For more PowerShell tips and tutorials, visit ITPro Today's YouTube channel.