I'm trying to write a Windows cmd.exe script to count the occurrences of aes after compiling a program from the command line. Its simply an Audit/QA script to ensure we're getting what we expect.

When I use findstr without the pipe, it appears to work fine:

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes
  000000C1: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000206: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000345: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000366: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  0000039F: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000078: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  000000AB: 66 0F 38 DC C8     aesenc      xmm1,xmm0

As soon as I pipe the result to find /c to count occurrences, things blow up. Not only does find not work as expected, it manages to break the proceeding findstr command.

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes | find /c aes
FIND: Parameter format not correct
FINDSTR: Write error

According to find /?:

If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.

How do I pipe the output of findstr to the input of find?


Use quotation marks on parameter of find /c "foo".


I was able to directly do what I needed to do with this syntax:

find.exe """Find This""" *.log

With the TRIPLE double quotes, I think 2 of them get consumed by POSH, leaving the single quote for FIND to see.. This worked fine for me on a Server 2012 R2..

  • 2
    The question has been satisfactorily answered by adding a " before the search string and another at the end.  If that doesn’t work for you, that suggests that you have a different situation.  The fact that you’re talking about “POSH”, which is not mentioned in the question, supports that. If you believe that your problem (whatever it is) applies to other people, you should ask a new question, describe your situation, and post your own answer.  (You may be subjected to a brief delay before the system will let you answer your own question.) Nov 17 '17 at 22:28
  • 3
    this answer is correct. I'm using power shell in ConEmu and need to use triple quotes. Please revert your downvote. Jan 10 '18 at 21:32
  • 5
    Seconding that this works/is needed using vanilla powershell on Win 10, where I was having the same problem.
    – Nat Bowman
    Aug 2 '18 at 18:31
  • 2
    I assume "POSH" means Powershell. I've never seen that term before. Confirmed this works for me though. So stupid that this is needed!
    – Ben
    Sep 27 '18 at 22:26
  • 1
    And again today. I know exactly how to use find, been doing so for years. But in powershell I could only get to work with triple quotes as this answer suggested. Sep 29 '20 at 14:52

The "string" parameter is compulsory in find. Try piping findstr to:

find /c /v ""

This also works:

find `"keyword`"

Whilst the multiple quotes works, another option may be to escape the quote, e.g. schtasks /query /tn "WMS Wait Monitor" /v /fo list | find `"Status:`"


There were helpful suggestions here. I needed to use this inside a forfiles loop and found that double quotes needed a backslash for it to work properly. Sample below:

cmd /C some_command | find /V \"something\"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.