Using SCOM get-scomalert criteria

The scom alerts for a particular computer can be retrieved by the following commands.

Get-SCOMAlert -ResolutionState 0 | ?{$_.PrincipalName -match 'SQL' -OR $_.PrincipalName -match 'WEB'}

Get-SCOMAlert -Criteria {ResolutionState = 0 and PrincipalName like '%SQL%'  or PrincipalName like '%WEB%'}}

There is significant difference in the time taken for the two commands to be processed.

PS C:\Windows\system32> Measure-Command{Get-SCOMAlert -ResolutionState 0 | ?{$_.PrincipalName -match 'SQL' -OR $_.PrincipalName -match 'WEB'}}
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 604
Ticks : 6047616
TotalDays : 6.99955555555556E-06
TotalHours : 0.000167989333333333
TotalMinutes : 0.01007936
TotalSeconds : 0.6047616
TotalMilliseconds : 604.7616

PS C:\Windows\system32> Measure-Command{Get-SCOMAlert -Criteria {ResolutionState = 0 and PrincipalName like '%SQL%'  or PrincipalName like '%WEB%'}}
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 156
Ticks : 1564777
TotalDays : 1.81108449074074E-06
TotalHours : 4.34660277777778E-05
TotalMinutes : 0.00260796166666667
TotalSeconds : 0.1564777
TotalMilliseconds : 156.4777

The winner is clearly the criteria field. The accepted ones are .

Id
Name
Description
MonitoringObjectId
MonitoringClassId
MonitoringObjectName
MonitoringObjectDisplayName
MonitoringObjectPath
MonitoringObjectFullName
IsMonitorAlert
ProblemId
MonitoringRuleId
ResolutionState
Priority
Severity
Category
Owner
ResolvedBy
TimeRaised
TimeAdded
LastModified
LastModifiedBy
TimeResolved
TimeResolutionStateLastModified
CustomField1
CustomField2
CustomField3
CustomField4
CustomField5
CustomField6
CustomField7
CustomField8
CustomField9
CustomField10
TicketId
Context
ConnectorId
LastModifiedByNonConnector
MonitoringObjectInMaintenanceMode
MonitoringObjectHealthState
ConnectorStatus
NetbiosComputerName
NetbiosDomainName
PrincipalName
AlertParams
SiteName
MaintenanceModeLastModified
StateLastModified

Some more examples using criteria.

Get-ScomAlert -criteria {"Name LIKE 'Failed to connect to computer%' and ResolutionState = 0"}

Get-ScomAlert -criteria {"TimeRaised > '01/03/2017 23:59:00' and ResolutionState != 0"}

$date = $(Get-Date).AddMinutes(-30).ToUniversalTime()
$Alerts = Get-ScomAlert -criteria "ResolutionState = 0 and TimeRaised > '$date'"

Get all new and critical alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=2"};$Alerts

Get all new and warning alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=1"};$Alerts

Get all new and informational alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=0"};$Alerts



Important note: The criteria parameters are case sensitive  so make sure you are using the right one.