clewmi v1.3 by Jared Cheney <jared@iLeaf.

net>
Licensed under the terms of the GNU General Public License.

Command Line WMI (CLeWMI) query tool. Allows one to perform simple Data
queries against WMI. Future release should support Schema and Event queries.

Usage: clewmi [options]

-c <class> WMI Class; i.e. Win32_Service

-s <server> Server you want to connect to. By default it is
localhost
-n <namespace> WMI NameSpace you want to connect to. By default
it is /root/cimV2
-p <properties> Specify which properties of each instance to
return. List the properties separated by commas
(no spaces) (i.e. Name,DisplayName,Size).
Without this flag, all properties will be
returned.
-f <Property[~|=]Value> Only Valid on Windows XP or 2003. Use -r flag for
Windows 2000. Filter what instances of a class
are returned (i.e. Name~Alert% will return
instances where Name property begins with 'Alert'
followed by anything)
To restrict to an exact match, instead
use = instead of ~ (i.e. Name=Alert will return
instances where Name property exactly matches
'Alert') You can also reverse the logic of the =
sign by prefacing it with ! (i.e. Name!=Alert
returns anything that does NOT have Name matching
'Alert') You can also filter on NULL or NOT NULL,
like this:
e.g. Name=NULL (returns instances with NULL Name
property)
Name!=NULL (returns instances whose Name
property is not NULL)
-r <Property[~|=]Value> Similar to above filter option, but less efficient.
It causes all instances of the specified class to
be returned from the WMI query, and then just
filters the output based on the value specified.
Windows 2000 does not support the LIKE operator in
WQL queries, hence this flag was created.
Syntax is PropertyName~Value, where Value is
evaluated as a regular expression, thus allowing
great flexibility. RegExp is case insensitive.
e.g. Name~windows.* (returns anything with name
property beginning with windows and followed
by 0 or more characters)
Like the -f option, if you use the = character
instead of the ~ character, it changes the
behaviour of the query slightly. Using != reverses
the match.
-w <WQL Query String> This flag allows you to specify an actual WQL
query string. If specified, then it overrides the
-f or -r flags, as well as the -c flags. Don't
use this unless you know what you're doing.
e.g. "Select * FROM Win32_Service WHERE Name =
 'Alerter'"
-o tab|csv|list Choose whether to display output in tab separated,
comma separated, or list style format. Default
is to display in list format.
--list Lists all possible properties for an instance of
the specified class.
--listMethods Lists all possible methods available for the
specified class.
--listNameSpaces Lists all available WMI NameSpaces on a machine
--listClasses Lists all available classes for the given
NameSpace, top level only (doesn't recurse in).
Will start at specific Class, if specified.
Only dynamic classes are listed.
--recurseClasses Lists all available classes for a given NameSpace,
and recurses down into each class. Will start
at specific Class, if specified. Lists all
subclasses, not just dynamic ones.
-v verbosity - use multiple times for greater effect
-l <logFile> logFile to be used.
-h | --help Display this help message
-V Display program version and exit
--nobanner Suppresses display of program name and version at
top of script output. Useful when gathering data
for import into a spreadsheet.
--convertDate Specify this option if you want dates returned
by WMI to be in a readable format. Default is to
simply return them in the format given.

EXAMPLES
clewmi -c Win32_Service --list
Lists all available properties for instances of the Win32_Service class

clewmi -c Win32_Service -p Name,Status -o tab --nobanner

Returns the Name and Status of all Services on a box in tab delimited
format. Script banner information is suppressed.

clewmi -c Win32_Service -p Name,DisplayName -f "state~%run%"

Returns the Name and DisplayName of all Services whose state contains
the word 'run' somewhere in it (-f only works on XP and 2003)

clewmi -c Win32_Service -p Name,DisplayName -r "state=run.*" -o csv

Returns the Name and DisplayName of all services whose state contains
the word 'run' followed by any set of characters. Results are listed
in csv format

clewmi --listNameSpaces
Lists all available namespaces installed on a computer

clewmi -n /root/cimv2 -s servername --listClasses

Lists all available top level classes available to the /root/cimv2
namespace on the remote computer servername