GetNir v1.00
Copyright (c) 2019 Nir Sofer

Description

GetNir is a command-line tool for Windows that receives tab-delimited or comma-delimited data from other NirSoft tools through Standard input (stdin) , finds and extracts the desired values according to the specified filter expression and column names, and then sends these values to the Standard output (stdout).

Examples for what you can do with GetNir

Get the current version of Google Chrome from the installed applications list generated by UninstallView UninstallView.exe /stab "" | GetNir "Display Version" "'Registry Name'='Google Chrome'"
Get the install location of Adobe Reader from the installed applications list generated by UninstallView: UninstallView.exe /stab "" | GetNir "Install Location" "'Display Name' Like 'Adobe Reader*'"
Get current application sound volume of VLC media player (in percent) , from SoundVolumeView tool SoundVolumeView.exe /stab "" | GetNir "Volume Percent" "'Process Path' LIKE *vlc.exe"
Get current sound volume (in percent) of Speakers device, from SoundVolumeView tool SoundVolumeView.exe /stab "" | GetNir "Volume Percent" "Name=Speakers && Type=Device"
Get name and device name of the default audio render device from SoundVolumeView tool SoundVolumeView.exe /stab "" | GetNir "Name,DeviceName" "Default=Render"
Get the email address of 'Nir Sofer' from the address book of Outlook, using OutlookAddressBookView tool OutlookAddressBookView.exe /stab "" | GetNir "EmailAddress" "DisplayName='Nir Sofer'"
Get the email address of 'Nir Sofer' (SMTP Record) from the AutoComplete file of Microsoft Outlook, using the NK2Edit tool nk2edit.exe /AddExportHeaderLine 1 /scomma "" | GetNir "Email/Exchange String" "DisplayName='Nir Sofer'"
Get the name of the person who has the support@nirsoft.net email address from the AutoComplete file of Microsoft Outlook, using the NK2Edit tool nk2edit.exe /AddExportHeaderLine 1 /scomma "" | GetNir "DisplayName" "Email/ExchangeString='support@nirsoft.net' || SMTPAddress='support@nirsoft.net'"
Get the current brightness of your monitor, using ControlMyMonitor tool ControlMyMonitor.exe /stab "" | GetNir "Current Value" "VCPCode=10"
Get the process ID and process name of the processes that listen to TCP ports 135-139, using CurrPorts tool: cports.exe /stab "" | GetNir "Process ID,Process Path" "LocalPort >= 135 && LocalPort <= 139 && State=Listening"
Get current CPU usage of Explorer.exe from the task manager of Windows, using SysExporter tool: sysexp.exe /Title "Windows Task Manager" /class SysListView32 /Visible Yes /stab "" | GetNir "CPU" "'Image Name'=Explorer.exe"
Get the serial number of plugged USB device (only if the serial number is available), using the USBDeview tool: USBDeview.exe /stab "" | GetNir "Serial Number" "Connected=Yes"
Get the drive letter of plugged USB Mass Storage device, using the USBDeview tool: USBDeview.exe /stab "" | GetNir "Drive Letter" "Connected=Yes AND 'Device Type'='Mass Storage'"
Get RSSI value of the MyNet wireless access point, using WifiInfoView tool: WifiInfoView.exe /stab "" | GetNir "RSSI" "SSID=MyNet"
Get the SSID, MAC Address, and RSSI of the access point you are connected at this moment WifiInfoView.exe /stab "" | GetNir "SSID,MACAddress,RSSI" "Connected=Yes"
Get the cookies of youtube.com stored in Chrome Web browser, using the ChromeCookiesView tool ChromeCookiesView.exe /stab "" | GetNir "Name, Value" "'Host Name' LIKE *youtube.com"
Get the number of established TCP connections of every firefox.exe process, using ProcessTCPSummary tool ProcessTCPSummary.exe /stab "" | GetNir "Process ID,TCP Established" "'Process Name' = firefox.exe"
Get the current download bandwidth of Firefox Web browser, using AppNetworkCounter (Requires to run the command-prompt window as Administrator) AppNetworkCounter.exe /CaptureTime 5000 /scomma "" | GetNir "ReceiveSpeed" "ApplicationName=firefox.exe"
Get the process name and path of application that uses the most download bandwidth (in the last 5 seconds). AppNetworkCounter sorts the output so the application with the most "Received Bytes" will be in the first line and then GetNir displays the application name and path only of the first line (/TopLines 1) AppNetworkCounter.exe /CaptureTime 5000 /Sort "~Received Bytes" /scomma "" | GetNir "ApplicationName,ApplicationPath" "" /TopLines 1
Get the name of your active display adapters, using DevManView tool (Requires to run the command-prompt window as Administrator) DevManView.exe /AddExportHeaderLine 1 /stab "" | GetNir "DeviceName" "DeviceTypeCode=Display And Connected=Yes"
Get the drive letter and name of active CD-ROM/DVD devices, using DevManView tool (Requires to run the command-prompt window as Administrator) DevManView.exe /AddExportHeaderLine 1 /stab "" | GetNir "DriveLetter,DeviceName" "DeviceTypeCode=CDROM And Connected=Yes"
Get the window title of Chrome Web browser, using GUIPropView GUIPropView.exe /stab "" | GetNir "Title" "Visible=Yes && ProcessFilename Like *chrome.exe"
Scan your local network and get name, MAC address, and manufacturer name of the device in IP address 192.168.0.36, using Wireless Network Watcher: WNetWatcher.exe /stab "" | GetNir "DeviceName,MACAddress,NetworkAdapterCompany" "IPAddress=192.168.0.36"
Get your current wireless network connection speed, using WirelessConnectionInfo tool: WirelessConnectionInfo.exe /stab "" | GetNir "Value" "Description='Receiving rate'"
Get the process name and path of the application with most active disk-write activity in the last 5 seconds. The output is first sorted by AppReadWriteCounter so the application with the largest "Write Bytes" is in the first line, and then GetNir takes only the first line (/TopLines 1) AppReadWriteCounter.exe /CaptureTime 5000 /sort "~Write Bytes" /scomma "" | GetNir "ApplicationName,ApplicationPath" "" /TopLines 1
Get the tasks that are currently running and their description, using TaskSchedulerView TaskSchedulerView.exe /stab "" | GetNir "TaskName,Description" "Status=Running"
Get the next 3 tasks (Task Name and Next Run Time) that the Task Scheduler of Windows going to run. TaskSchedulerView.exe /sort "Next Run" /stab "" | GetNir "TaskName,NextRun" "NextRun != ''" /TopLines 3
Get the command-line that is used to open .mp4 files on your system, using the FileTypesMan tool. (Requires to run the command-prompt window as Administrator) FileTypesMan.exe /SelectedExt .mp4 /AddExportHeaderLine 1 /scomma "" | GetNir "Command-Line" "Name=Open"

Be aware that the above examples will work only when the 'Add Header Line To CSV/Tab-Delimited File' option is turned on.

System Requirements

This tool works on any version of Windows - From Windows XP and up to Windows 10.

Usage

GetNir [Display Columns] [Filter Expression] {More Options}

The [Display Columns] contains the name of one or more columns (comma-delimited list) to display. For example: "Install Location"   "Display Name,Display Version"
You can use the column numbers instead of column names, for example: "Column1,Column3"
If [Display Columns] is an empty string, GetNir will display the entire csv/tab-delimited line.

The [Filter Expression] is an expression similar to the SQL WHERE clause that filters the records you want to see.

In the {More Options} section you can use the following options:

/NoColumnNames If the first line of the tab-delimited/comma-delimited data doesn't contain the column/field names (In NirSoft tools - 'Add Header Line To CSV/Tab-Delimited File' option is turned off) you should specify the /NoColumnNames command-line option.
In the [Display Columns] and [Filter Expression] you should use Column1 as name of the first column, Column2 as name of the second column, and so on...
/TopLines {Number Of Lines} Display only the top xx lines.

The Filter Expression

  • The filter expression is similar to the SQL WHERE clause and allows you to filter the records you want to see.
  • You must put the entire filter expression in double quotes ("") and also every field name or string in the expression that contains one or more space characters must be in single quotes ('').
  • When a column name has space characters, you can omit the spaces and then there is no need to put the name in single quotes. For example: Instead of 'Display Name', you can specify the column name as DisplayName.
  • The following operators are supported: =   !=   >   <   >=   <=   Like Contains BeginsWith EndsWith Not And Or . You can use && instead of 'And' , || instead of 'Or', like in C/C++/C#/Java.
  • The gt;   <   >=   <= operators can be used for numeric columns to get the desired range, for example: "Channel >= 1 && Channel <= 3"
  • The Like operator checks a string using a wildcard, for example: "DisplayName LIKE 'Mozilla Firefox*'"   "SSID LIKE 'MyNet?'"
  • The BeginsWith operator checks if a string begins with the specified string, for example: "DisplayName BeginsWith 'Mozilla Firefox'"
  • The EndsWith operator checks if a string ends with the specified string, for example: "'Host Name' EndsWith .com"
  • The Contains operator checks if a string contains the specified string, for example: "'Host Name' Contains Google"
  • You can use the NOT operator to reverse the result, for example... If you want to get all records that their 'Host Name' doesn't contain the 'Google' string: "'Host Name' Not Contains Google"
  • You can use column numbers instead of column names. Column1 for the first column, Column2 for the second column, and so on. For example: "Column1=5 && Column3=10"

Using GetNir With NirSoft Tools

In most NirSoft tools you can send tab-delimited or comma-delimited data to stdout by specifying empty string ("") instead of filename, for example:
UninstallView.exe /stab ""

This feature allows you work directly with GetNir without writing the data to a file.

In order to type the correct column name to display and filter, you have to look at the names of the columns as they appear in the GUI and inside exported files:

So now let's say that you want to get the uninstall string of Google Chrome from the UninstallView tool:
UninstallView.exe /stab "" | GetNir "Uninstall String" "'Registry Name'='Google Chrome'"

In the above command, UninstallView sends to stdout the list of all installed programs, as tab-delimited format. GetNir receives the data from UninstallView and searches the record with 'Google Chrome' value under the 'Registry Name' column. When GetNir finds the record, it display the value of 'Uninstall String' column:

You can also use the column names without space characters, for example:
UninstallView.exe /stab "" | GetNir "UninstallString" "RegistryName='Google Chrome'"

If you already have the csv/tab-delimited data on a file, you can also use GetNir to extract the desired value from the file, for example:
GetNir "UninstallString" "RegistryName='Google Chrome'" < uninstallview.csv

License

This utility is released as freeware. You are allowed to freely distribute this utility via CD-ROM, DVD, Internet, or in any other way, as long as you don't charge anything for this and you don't sell it or distribute it as a part of commercial product. If you distribute this utility, you must include all files in the distribution package, without any modification !

Disclaimer

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

Feedback

If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to support@nirsoft.net

Download GetNir