PowerShell – Search against large .csv file(s) for a string

Previously, I had exported log files of considerable size parsing for certain columns of data to multiple .csv files.  Now I had wanted a response file with corresponding variable(s) and each entry (i.e. time stamp etc.) searching against one or multiple files. Below had been the process for this search and export. In this example, I had been using Windows 2012.

1. Right-click on the PowerShell icon and select RUN AS ADMINISTRATOR and OPEN.



2. Determine PowerShell version with the following command: $host.version

IMPORTANT: PowerShell 2.0 and above must be used to support the forthcoming commands.


3. Change directory to .csv file(s) location  (i.e. c:\logs)


CD C:\logs

4. Create a directory to place your exported results (i.e. c:\garzafx)

5. Run the following command to export search to .csv file

Get-ChildItem | Get-Content | Select-String -pattern “ellen ripley” | export-csv c:\garzafx\ellen.ripley.csv

a. Get-ChildItem will reference the file or files within the current directory. For my purposes here and the size of the data files, I had referenced few at a time.

b. Get-Content, simply had taken what Get-ChildItem pulled from the aforementioned directory (i.e. C:\logs)

C. Select-string -pattern, This had provided the variable (i.e. ellen ripley)

6. Here had been the export results with time stamp and pattern match for Ellen Ripley.


More examples and information on these PowerShell commands:

Get-ChildItem (Microsoft Technet)

Get-Content (Microsoft Technet)

Select-String (Microsoft Technet)

To Get PowerShell 3.0

Download Powershell 3.0

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s