Select-String

Syntax

Select-String
      [-Pattern] <String[]>
      [-Path] <String[]>
      [-SimpleMatch]
      [-CaseSensitive]
      [-Quiet]
      [-List]
      [-Include <String[]>]
      [-Exclude <String[]>]
      [-NotMatch]
      [-AllMatches]
      [-Encoding <String>]
      [-Context <Int32[]>]
      [<CommonParameters>]

Select-String
      -InputObject <PSObject>
      [-Pattern] <String[]>
      [-SimpleMatch]
      [-CaseSensitive]
      [-Quiet]
      [-List]
      [-Include <String[]>]
      [-Exclude <String[]>]
      [-NotMatch]
      [-AllMatches]
      [-Encoding <String>]
      [-Context <Int32[]>]
      [<CommonParameters>]

Select-String
      [-Pattern] <String[]>
      -LiteralPath <String[]>
      [-SimpleMatch]
      [-CaseSensitive]
      [-Quiet]
      [-List]
      [-Include <String[]>]
      [-Exclude <String[]>]
      [-NotMatch]
      [-AllMatches]
      [-Encoding <String>]
      [-Context <Int32[]>]
      [<CommonParameters>]

Description

The Select-String cmdlet searches for text and text patterns in input strings and files. You can use it like Grep in UNIX and Findstr in Windows. You can type Select-String or its alias, sls .

Select-String is based on lines of text. By default, Select-String finds the first match in each line and, for each match, it displays the file name, line number, and all text in the line containing the match. However, you can direct it to detect multiple matches per line, display text before and after the match, or display only a Boolean value (True or False) that indicates whether a match is found.

Select-String uses regular expression matching, but it can also perform a simple match that searches the input for the text that you specify.

Select-String can display all of the text matches or stop after the first match in each input file. It can also display all text that does not match the specified pattern. You can also specify that Select-String should expect a particular character encoding, such as when you are searching files of Unicode text.

Examples

Example 1: Find a case-sensitive match

PS C:\> "Hello","HELLO" | Select-String -Pattern "HELLO" -CaseSensitive

This command performs a case-sensitive match of the text that was piped to the Select-String command.

As a result, Select-String finds only "HELLO", because "Hello" does not match.

Because each of the quoted strings is treated as a line, without the CaseSensitive parameter, Select-String would recognize both of the strings as matches.

Example 2: Find matches in XML files only

PS C:\> Select-String -Path "*.xml" -Pattern "the the"

This command searches through all files with the .xml file name extension in the current directory and displays the lines in those files that include the string "the the".

Example 3: Find a pattern match

PS C:\> Select-String -Path "$pshome\en-US\*.txt" -Pattern "@"

This command searches the Windows PowerShell conceptual Help files (about_*.txt) for information about the use of the at sign (@).

To indicate the path, this command uses the value of the $pshome automatic variable, which stores the path to the Windows PowerShell installation directory. In this example, the command searches the en-US subdirectory, which contains the English (US) language Help files for Windows PowerShell.

Example 4: Use Select-String in a function

PS C:\> function search-help

{

   $pshelp = "$pshome\es\about_*.txt", "$pshome\en-US\*dll-help.xml"

   Select-String -path $pshelp -Pattern $args[0]

}

This simple function uses the Select-String cmdlet to search the Windows PowerShell Help files for a particular string. In this example, the function searches the "en-US" subdirectory for English-United States language files.

To use the function to find a string, such as "psdrive", type search-help psdrive .

To use this function in any Windows PowerShell console, change the path to point to the Windows PowerShell Help files on your system, and then paste the function in your Windows PowerShell profile.

Example 5: Search for a string in the Application log

PS C:\> $Events = Get-EventLog -LogName application -Newest 100

PS C:\> $Events | Select-String -InputObject {$_.message} -Pattern "failed"

This example searches for the string "failed" in the 100 newest events in the Application log in Event Viewer.

The first command uses the Get-EventLog cmdlet to get the 100 most recent events from the Application event log. Then it stores the events in the $Events variable.

The second command uses a pipeline operator (|) to send the objects in the $Events variable to Select-String . It uses the InputObject parameter to represent the input from the $Events variable. The value of the InputObject parameter is the Message property of each object as it travels through the pipeline. The current object is represented by the $_ symbol.

As each event arrives in the pipeline, Select-String searches the value of its Message property for the "failed" string, and then displays any lines that include a match.

Example 6: Find a string in subdirectories

PS C:\> Get-ChildItem c:\windows\system32\*.txt -Recurse | Select-String -Pattern "Microsoft" -CaseSensitive

This command examines all files in the subdirectories of C:\Windows\System32 with the .txt file name extension and searches for the string "Microsoft". The CaseSensitive parameter indicates that the "M" in "Microsoft" must be capitalized and that the rest of the characters must be lowercase for Select-String to find a match.

Example 7: Find strings that do not match a pattern

PS C:\> Select-String -Path "process.txt" -Pattern "idle, svchost" -NotMatch

This command finds lines of text in the Process.txt file that do not include the words "idle" or "svchost".

Example 8: Find lines before and after a match

PS C:\> $F = Select-String -Path "audit.log" -Pattern "logon failed" -Context 2, 3

PS C:\> $F.count

PS C:\> ($F)[0].context | Format-List

The first command searches the Audit.Log file for the phrase "logon failed." It uses the Context parameter to capture 2 lines before the match and 3 lines after the match.

The second command uses the Count property of object arrays to display the number of matches found, in this case, 2.

The third command displays the lines stored in the Context property of the first MatchInfo object. It uses array notation to indicate the first match (match 0 in a zero-based array), and it uses the Format-List cmdlet to display the value of the Context property as a list.

The output consists of two MatchInfo objects, one for each match detected. The context lines are stored in the Context property of the MatchInfo object.

Example 9: Find all pattern matches

PS C:\> $A = Get-ChildItem $pshome\en-us\about*.help.txt | Select-String -Pattern "transcript"

PS C:\> $B = Get-ChildItem $pshome\en-us\about*.help.txt | Select-String -Pattern "transcript" -AllMatches

PS C:\> $A

C:\Windows\system32\WindowsPowerShell\v1.0\en-us\about_Pssnapins.help.txt:39:       Start-Transcript and Stop-Transcript. PS C:\> $B

C:\Windows\system32\WindowsPowerShell\v1.0\en-us\about_Pssnapins.help.txt:39:       Start-Transcript and Stop-Transcript. PS C:\> $A.matches

Groups   : {Transcript}

Success  : True

Captures : {Transcript}

Index    : 13

Length   : 10

Value    : Transcript PS C:\> $B.matches



Groups   : {Transcript}

Success  : True

Captures : {Transcript}

Index    : 13

Length   : 10

Value    : Transcript

Groups   : {Transcript}

Success  : True

Captures : {Transcript}

Index    : 33

Length   : 10

Value    : Transcript

This example demonstrates the effect of the AllMatches parameter of Select-String . AllMatches finds all pattern matches in a line, instead of just finding the first match in each line.

The first command in the example searches the Windows PowerShell conceptual Help files ("about" Help) for instances of the word "transcript". The output of the first command is saved in the $A variable.

The second command is identical, except that it uses the AllMatches parameter. The output of the second command is saved in the $B variable.

When you display the value of the variables, the default display is identical, as shown in the example output.

However, the fifth and sixth commands display the value of the Matches property of each object. The Matches property of the first command contains just one match (that is, one System.Text.RegularExpressions.Match object), whereas the Matches property of the second command contains objects for both of the matches in the line.

Required Parameters

Optional Parameters

Inputs

System.Management.Automation.PSObject

You can pipe any object that has a ToString method to Select-String .

Outputs

Microsoft.PowerShell.Commands.MatchInfo or System.Boolean

By default, the output is a set of MatchInfo objects, one for each match found. If you use the Quiet parameter, the output is a Boolean value indicating whether the pattern was found.

Notes

• Select-String is like the Grep command in UNIX and the FindStr command in Windows.
• The sls alias for the Select-String cmdlet was introduced in Windows PowerShell 3.0.

• To use Select-String , type the text that you want to find as the value of the Pattern parameter.

  To specify the text to be searched, do the following:

  • Type the text in a quoted string, and then pipe it to Select-String .

  • Store a text string in a variable, and then specify the variable as the value of the InputObject parameter.

  • If the text is stored in files, use the Path parameter to specify the path to the files.

• By default, Select-String interprets the value of the Pattern parameter as a regular expression. (For more information, see about_Regular_Expressions.) However, you can use the SimpleMatch parameter to override the regular expression matching. The SimpleMatch parameter finds instances of the value of the Pattern parameter in the input.

• The default output of Select-String is a MatchInfo object, which includes detailed information about the matches. The information in the object is useful when you are searching for text in files, because MatchInfo objects have properties such as Filename and Line. When the input is not from the file, the value of these parameters is InputStream.
• If you do not need the information in the MatchInfo object, use the Quiet parameter, which returns a Boolean value (True or False) to indicate whether it found a match, instead of a MatchInfo object.
• When matching phrases, Select-String uses the current culture that is set for the system. To find the current culture, use the Get-Culture cmdlet.

• To find the properties of a MatchInfo object, type the following:

  Select-String -Path test.txt -Pattern "test" | Get-Member | Format-List -Property *

RELATED LINKS