15

I'm trying to write a Windows cmd.exe script to count the occurrences of aes after compiling a program from the command line. Its simply an Audit/QA script to ensure we're getting what we expect.

When I use findstr without the pipe, it appears to work fine:

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes
  000000C1: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000206: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000345: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000366: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  0000039F: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000078: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  000000AB: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  ...

As soon as I pipe the result to find /c to count occurrences, things blow up. Not only does find not work as expected, it manages to break the proceeding findstr command.

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes | find /c aes
FIND: Parameter format not correct
FINDSTR: Write error

According to find /?:

If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.

How do I pipe the output of findstr to the input of find?

jww
  • 12,146
  • 46
  • 125
  • 210

7 Answers7

31

I was able to directly do what I needed to do with this syntax:

find.exe """Find This""" *.log

With the TRIPLE double quotes, I think 2 of them get consumed by POSH, leaving the single quote for FIND to see.. This worked fine for me on a Server 2012 R2..

jww
  • 12,146
  • 46
  • 125
  • 210
user2526332
  • 421
  • 3
    The question has been satisfactorily answered by adding a " before the search string and another at the end.  If that doesn’t work for you, that suggests that you have a different situation.  The fact that you’re talking about “POSH”, which is not mentioned in the question, supports that. If you believe that your problem (whatever it is) applies to other people, you should ask a new question, describe your situation, and post your own answer.  (You may be subjected to a brief delay before the system will let you answer your own question.) – G-Man Says 'Reinstate Monica' Nov 17 '17 at 22:28
  • 3
    this answer is correct. I'm using power shell in ConEmu and need to use triple quotes. Please revert your downvote. – Amadeusz Wieczorek Jan 10 '18 at 21:32
  • 5
    Seconding that this works/is needed using vanilla powershell on Win 10, where I was having the same problem. – Nat Bowman Aug 02 '18 at 18:31
  • 2
    I assume "POSH" means Powershell. I've never seen that term before. Confirmed this works for me though. So stupid that this is needed! – Ben Sep 27 '18 at 22:26
  • 1
    And again today. I know exactly how to use find, been doing so for years. But in powershell I could only get to work with triple quotes as this answer suggested. – Doug Maurer Sep 29 '20 at 14:52
  • Oh my... Glad I work on Linux – Déjà vu Dec 19 '23 at 13:02
7

Use quotation marks on parameter of find /c "foo".

week
  • 3,316
3

This also works:

find `"keyword`"
Hawk Zhang
  • 41
1

The "string" parameter is compulsory in find. Try piping findstr to:

find /c /v ""
SΛLVΘ
  • 1,405
0

Whilst the multiple quotes works, another option may be to escape the quote, e.g. schtasks /query /tn "WMS Wait Monitor" /v /fo list | find `"Status:`"

user1147609
  • 1
0

There were helpful suggestions here. I needed to use this inside a forfiles loop and found that double quotes needed a backslash for it to work properly. Sample below:

cmd /C some_command | find /V \"something\"

Tony Trus
  • 1
0

The TRIPLE double quotes solution as posted by user2526332 was the only thing that worked for me as well, when trying to find a specific port number in netstat output using powershell. When I don't use any parameters for netstat, it works well with one pair of double quotes:

netstat | find "1723"

But this continues to listen for a long time, so I wanted to do the same operation for netstat -an, and then I got the error "FIND: Parameter format not correct". The TRIPLE double quotes solved this:

netstat -an | find """1723"""

I tried single quotes in front of each double quote, but that didn't work.

Thor
  • 11