"FIND: Parameter format not correct" and "FINDSTR: Write error" with Pipes

Question

I'm trying to write a Windows cmd.exe script to count the occurrences of aes after compiling a program from the command line. Its simply an Audit/QA script to ensure we're getting what we expect.

When I use findstr without the pipe, it appears to work fine:

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes
  000000C1: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000206: 66 0F 3A DF C0 00  aeskeygenassist xmm0,xmm0,0
  00000345: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000366: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  0000039F: 66 0F 38 DB 04 81  aesimc      xmm0,xmmword ptr [ecx+eax*4]
  00000078: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  000000AB: 66 0F 38 DC C8     aesenc      xmm1,xmm0
  ...

As soon as I pipe the result to find /c to count occurrences, things blow up. Not only does find not work as expected, it manages to break the proceeding findstr command.

cryptopp-5.6.3>dumpbin /disasm Win32/cryptlib/Debug/rijndael.obj | findstr aes | find /c aes
FIND: Parameter format not correct
FINDSTR: Write error

According to find /?:

If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.

How do I pipe the output of findstr to the input of find?

score 33 · Answer 1 · edited Dec 26 '19 at 22:11

33

I was able to directly do what I needed to do with this syntax:

find.exe """Find This""" *.log

With the TRIPLE double quotes, I think 2 of them get consumed by POSH, leaving the single quote for FIND to see.. This worked fine for me on a Server 2012 R2..

edited Dec 26 '19 at 22:11

jww

12,722

answered Nov 17 '17 at 21:37

user2526332

441

score 7 · Accepted Answer · answered Oct 06 '15 at 19:09

7

Use quotation marks on parameter of find /c "foo".

answered Oct 06 '15 at 19:09

week

3,336
1
15
15

score 3 · Answer 3 · answered Mar 30 '21 at 07:08

3

This also works:

find `"keyword`"

answered Mar 30 '21 at 07:08

Hawk Zhang

41

score 2 · Answer 4 · answered Aug 16 '22 at 11:40

The TRIPLE double quotes solution as posted by user2526332 was the only thing that worked for me as well, when trying to find a specific port number in netstat output using powershell. When I don't use any parameters for netstat, it works well with one pair of double quotes:

netstat | find "1723"

But this continues to listen for a long time, so I wanted to do the same operation for netstat -an, and then I got the error "FIND: Parameter format not correct". The TRIPLE double quotes solved this:

netstat -an | find """1723"""

I tried single quotes in front of each double quote, but that didn't work.

score 1 · Answer 5 · answered Oct 06 '15 at 19:10

1

The "string" parameter is compulsory in find. Try piping findstr to:

find /c /v ""

answered Oct 06 '15 at 19:10

SΛLVΘ

1,465

score 0 · Answer 6 · answered Mar 08 '20 at 07:36

0

Whilst the multiple quotes works, another option may be to escape the quote, e.g. schtasks /query /tn "WMS Wait Monitor" /v /fo list | find `"Status:`"

answered Mar 08 '20 at 07:36

user1147609

1

score 0 · Answer 7 · answered Aug 06 '21 at 14:26

0

There were helpful suggestions here. I needed to use this inside a forfiles loop and found that double quotes needed a backslash for it to work properly. Sample below:

cmd /C some_command | find /V \"something\"

answered Aug 06 '21 at 14:26

Tony Trus

1

"FIND: Parameter format not correct" and "FINDSTR: Write error" with Pipes

7 Answers7

Linked