Select-String

Select-String [-Path] <string[]> [-Pattern] <string[]> [-AllMatches] [-CaseSensitive] [-Context <Int32[]>] [-Encoding <string>] [-Exclude <string[]>] [-Include <string[]>] [-List] [-NotMatch] [-Quiet] [-SimpleMatch] [<CommonParameters>]

Select-String -InputObject <psobject> [-Pattern] <string[]> [-AllMatches] [-CaseSensitive] [-Context <Int32[]>] [-Encoding <string>] [-Exclude <string[]>] [-Include <string[]>] [-List] [-NotMatch] [-Quiet] [-SimpleMatch] [<CommonParameters>]

C:\PS>"Hello","HELLO" | select-string -pattern "HELLO" -casesensitive

This command performs a case-sensitive match of the text that was piped to the Select-String command. 

As a result, Select-String finds only "HELLO", because "Hello" does not match.

Because each of the quoted strings is treated as a line, without the CaseSensitive parameter, Select-String would recognize both of the strings as matches.

C:\PS>select-string -path *.xml -pattern "the the"

This command searches through all files with the .xml file name extension in the current directory and displays the lines in those files that include the string "the the".

C:\PS>select-string -path $pshome\en-US\*.txt -pattern "@"

This command searches the Windows PowerShell conceptual Help files (about_*.txt) for information about the use of the at sign (@). 

To indicate the path, this command uses the value of the $pshome automatic variable, which stores the path to the Windows PowerShell installation directory. In this example, the command searches the en-US subdirectory, which contains the English (US) language Help files for Windows PowerShell.

C:\PS>function search-help
{
    $pshelp = "$pshome\es\about_*.txt", "$pshome\en-US\*dll-help.xml"
    select-string -path $pshelp -pattern $args[0]
}

This simple function uses the Select-String cmdlet to search the Windows PowerShell Help files for a particular string. In this example, the function searches the "en-US" subdirectory for English-United States language files.

To use the function to find a string, such as "psdrive", type "search-help psdrive".

To use this function in any Windows PowerShell console, change the path to point to the Windows PowerShell Help files on your system, and then paste the function in your Windows PowerShell profile.

C:\PS>$events = get-eventlog -logname application -newest 100

C:\PS> $events | select-string -inputobject {$_.message} -pattern "failed"

This example searches for the string "failed" in the 100 newest events in the Application log in Event Viewer.

The first command uses the Get-EventLog cmdlet to get the 100 most recent events from the Application event log. Then it stores the events in the $events variable. 

The second command uses a pipeline operator (|) to send the objects in the $events variable to Select-String. It uses the InputObject parameter to represent the input from the $events variable. The value of the InputObject parameter is the Message property of each object as it travels through the pipeline. The current object is represented by the $_ symbol.

As each event arrives in the pipeline, Select-String searches the value of its Message property for the "failed" string, and then displays any lines that include a match.

C:\PS>get-childitem c:\windows\system32\* -include *.txt -recurse |
select-string -pattern "Microsoft" -casesensitive

This command examines all files in the subdirectories of C:\Windows\System32 with the .txt file name extension and searches for the string "Microsoft". The CaseSensitive parameter indicates that the "M" in "Microsoft" must be capitalized and that the rest of the characters must be lowercase for Select-String to find a match.

C:\PS>select-string -path process.txt -pattern idle, svchost -notmatch

This command finds lines of text in the Process.txt file that do not include the words "idle" or "svchost".

C:\PS>$f = select-string -path audit.log -pattern "logon failed" -context 2, 3

C:\PS> $f.count

C:\PS> ($f)[0].context | format-list

The first command searches the Audit.Log file for the phrase "logon failed." It uses the Context parameter to capture 2 lines before the match and 3 lines after the match. 

The second command uses the Count property of object arrays to display the number of matches found, in this case, 2. 

The third command displays the lines stored in the Context property of the first MatchInfo object. It uses array notation to indicate the first match (match 0 in a zero-based array), and it uses the Format-List cmdlet to display the value of the Context property as a list.

The output consists of two MatchInfo objects, one for each match detected. The context lines are stored in the Context property of the MatchInfo object.

C:\PS>$a = get-childitem $pshome\en-us\about*.help.txt | select-string -pattern transcript

C:\PS> $b = get-childitem $pshome\en-us\about*.help.txt | select-string -pattern transcript -allmatches

C:\PS> $a
C:\Windows\system32\WindowsPowerShell\v1.0\en-us\about_Pssnapins.help.txt:39:       Start-Transcript and Stop-Transcript.

C:\PS> $b
C:\Windows\system32\WindowsPowerShell\v1.0\en-us\about_Pssnapins.help.txt:39:       Start-Transcript and Stop-Transcript.


C:\PS>> $a.matches
Groups   : {Transcript}
Success  : True
Captures : {Transcript}
Index    : 13
Length   : 10
Value    : Transcript


C:\PS> $b.matches
Groups   : {Transcript}
Success  : True
Captures : {Transcript}
Index    : 13
Length   : 10
Value    : Transcript

Groups   : {Transcript}
Success  : True
Captures : {Transcript}
Index    : 33
Length   : 10
Value    : Transcript


Description
-----------
This example demonstrates the effect of the AllMatches parameter of Select-String. AllMatches finds all pattern matches in a line, instead of just finding the first match in each line.

The first command in the example searches the Windows PowerShell conceptual Help files ("about" Help) for instances of the word "transcript". The second command is identical, except that it uses the AllMatches parameter.

The output of the first command is saved in the $a variable. The output of the second command is saved in the $b variable. 

When you display the value of the variables, the default display is identical, as shown in the example output.

However, the fifth and sixth commands display the value of the Matches property of each object. The Matches property of the first command contains just one match (that is, one System.Text.RegularExpressions.Match object), whereas the Matches property of the second command contains objects for both of the matches in the line.