Prof. Powershell

Match Play: PowerShell's Match Operator

Last time, we used the like operator to find wildcard type matches. Now, let's find exactly what we're searching for with -Match.

• By Jeffery Hicks
• 08/07/2012

Last time we looked at using the Like operator to find wildcard type matches. The other operator you can use is -Match (and its opposite, -notmatch). This works very similar to -like except instead of using a wildcard, you use a regular expression pattern.

Now, before your eyes roll back in your head at the mention of regular expressions, let's look at an example of a pattern, which can be as simple as a string:

PS C:\> Get-Service | where {$_.status -match "running"}

In this context, we are still looking at a case-insensitive comparison. Unlike using like and wildcards, we can use -Match to find partial matches anywhere in a string:

PS C:\> get-process | where {$_.name -match "log"}

This will return all processes that have log anywhere in the name property. This is the same thing as running:

PS C:\> get-process | where {$_.name -like "*log*"}

For simple comparisons like this it probably doesn't matter which operator you use. Just remember that the match pattern "floats". However you can anchor it. For example, if we want to find all processes that start with "win" we can anchor our pattern with the ^ character:

PS C:\> get-process | where {$_.name -match "^win"}

This should return processes like winit and winlogon. Yes, I realize this not the best way to do this but it makes for a simple example. If we want to find something that is anchored at the end we use the $:

PS C:\> get-process | where {$_.name -match "host$"}

This should return processes like svchost, taskhost and conhost, depending on your operating system. You can also combine the two anchors:

PS C:\> get-process | where {$_.name -match "^powershell$"}

If you have the PowerShell ISE open as well as least one instance of the console, this example should only return the console process. If by chance you had something else running that had PowerShell in the name it too would not be returned. Granted, this is the same thing as running:

PS C:\> get-process | where {$_.name -eq "powershell"}

Again, my example is just an illustration of -match, not how to use Get-Process. But trust me, the -match operator will start getting more interesting once you learn a bit more about regular expressions, which we'll dive into next time.