15

I'm trying to write a Windows cmd.exe script to count the occurrences of aes after compiling a program from the command line. Its simply an Audit/QA script to ensure we're getting what we expect.

When I use findstr without the pipe, it appears to work fine:

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes
  000000C1: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000206: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000345: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000366: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  0000039F: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000078: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  000000AB: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  ...

As soon as I pipe the result to find /c to count occurrences, things blow up. Not only does find not work as expected, it manages to break the proceeding findstr command.

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes | find /c aes
FIND: Parameter format not correct
FINDSTR: Write error

According to find /?:

If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.

How do I pipe the output of findstr to the input of find?

Improve this question

7 Answers 7

Reset to default
7

Use quotation marks on parameter of find /c "foo".

Improve this answer
31

I was able to directly do what I needed to do with this syntax:

find.exe """Find This""" *.log

With the TRIPLE double quotes, I think 2 of them get consumed by POSH, leaving the single quote for FIND to see.. This worked fine for me on a Server 2012 R2..

Improve this answer
6
  • 3
    The question has been satisfactorily answered by adding a " before the search string and another at the end.  If that doesn’t work for you, that suggests that you have a different situation.  The fact that you’re talking about “POSH”, which is not mentioned in the question, supports that. If you believe that your problem (whatever it is) applies to other people, you should ask a new question, describe your situation, and post your own answer.  (You may be subjected to a brief delay before the system will let you answer your own question.)
    – G-Man Says 'Reinstate Monica'
    Nov 17, 2017 at 22:28
  • 3
    this answer is correct. I'm using power shell in ConEmu and need to use triple quotes. Please revert your downvote.
    – Amadeusz Wieczorek
    Jan 10, 2018 at 21:32
  • 5
    Seconding that this works/is needed using vanilla powershell on Win 10, where I was having the same problem.
    – Nat Bowman
    Aug 2, 2018 at 18:31
  • 2
    I assume "POSH" means Powershell. I've never seen that term before. Confirmed this works for me though. So stupid that this is needed!
    – Ben
    Sep 27, 2018 at 22:26
  • 1
    And again today. I know exactly how to use find, been doing so for years. But in powershell I could only get to work with triple quotes as this answer suggested.
    – Doug Maurer
    Sep 29, 2020 at 14:52
3

This also works:

find `"keyword`"
Improve this answer
1

The "string" parameter is compulsory in find. Try piping findstr to:

find /c /v ""
Improve this answer
1

The TRIPLE double quotes solution as posted by user2526332 was the only thing that worked for me as well, when trying to find a specific port number in netstat output using powershell. When I don't use any parameters for netstat, it works well with one pair of double quotes:

netstat | find "1723"

But this continues to listen for a long time, so I wanted to do the same operation for netstat -an, and then I got the error "FIND: Parameter format not correct". The TRIPLE double quotes solved this:

netstat -an | find """1723"""

I tried single quotes in front of each double quote, but that didn't work.

Improve this answer
0

Whilst the multiple quotes works, another option may be to escape the quote, e.g. schtasks /query /tn "WMS Wait Monitor" /v /fo list | find `"Status:`"

Improve this answer
0

There were helpful suggestions here. I needed to use this inside a forfiles loop and found that double quotes needed a backslash for it to work properly. Sample below:

cmd /C some_command | find /V \"something\"

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .