Agreed with Rich, since this is very specific to PowerShell, not Splunk. But I'll give you a hint real quick. You need to look at two areas: filtering, and working with objects generally. You can use a variety of methods to filter input. One is the Where-Object cmdlet. But when working with PowerShell, it's best to convert text strings into objects, as it's much easier to work with them that way. This script that I found real quick (I googled for "powershell query rdc") shows a technique to use the qwinsta.exe command, but then converting the output to CSV, and then using the ConvertFrom-CSV to turn it into objects.