Previous Next

Thread: Print summary

Last post 08-27-2008 6:38 AM by yellowdog.dave. 9 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (10 items)

Sort Posts:

  • 08-07-2008, 3:59 AM

    Print summary

    Hello, I am newbie with LP. I want to parse System log for print events. I need to sum number of pages printed by every user on specific printer. Unfortunately, all these information are stored in one text field Message. Is there a way how to trim, count and sum text strings in one field ? Thank you for your time and help. Here is the field example :

    Document 121, Microsoft Word - 1218095142444.doc of user kpkretom has been printed on printer ULPU HP 5100 PCL 6 on port IP_172.16.11.206. Size in bytes: 34456; printed pages: 1

     

     

  • 08-07-2008, 6:44 AM In reply to

    • yellowdog.dave
    • Top 50 Contributor
    • Joined on 07-18-2008, 3:17 AM
    • Johannesburg, South Africa
    • Posts 66

    Re: Print summary

    Hi There, 

    I took your text line and replicated into a file called print.txt like this;

    Document 121, Microsoft Word - 1218095142444.doc of user kpkretom has been printed on printer ULPU HP 5100 PCL 6 on port IP_172.16.11.206. Size in bytes: 34456; printed pages: 1
    Document 121, Microsoft Word - 1218095142444.doc of user kpkretom has been printed on printer ULPU HP 5100 PCL 6 on port IP_172.16.11.206. Size in bytes: 34456; printed pages: 5
    Document 121, Microsoft Word - 1218095142444.doc of user kpkretom has been printed on printer ULPU HP 5100 PCL 6 on port IP_172.16.11.206. Size in bytes: 34456; printed pages: 3

    Then I wrote a query file called print.sql which looks like this;

    select extract_token(EXTRACT_TOKEN( Text, -1, 'user' ),1,' ') as User,
    trim(extract_token(EXTRACT_TOKEN( Text, -1, 'on printer' ),0,'on port ')) as Printer,
    count(*) as Documents,
    sum(to_int(extract_token(EXTRACT_TOKEN( Text, -1, ':' ),1,' '))) as Pages
    from print.txt
    group by User, Printer

    Then I run the following command in a dos prompt;

    logparser file:print.sql 

    And I get output that looks like this;

    WARNING: Input format not specified - using TEXTLINE input format.
    User         Printer                            Documents Pages
    --------        ------------------                      ---------         -----
    kpkretom   ULPU HP 5100 PCL 6                3         9

    Statistics:
    -----------
    Elements processed: 3
    Elements output:    1
    Execution time:     0.05 seconds

    I presume that this is what you were looking for, now you can pump that data into any other output format you want. 

    Good luck. 

    Cheers, Dave 

    Yes, dear
  • 08-07-2008, 7:52 AM In reply to

    Re: Print summary

    Dave, thank you very much. May I ask you more ? Do you think its possible to dump it directly from computer Event log ? Without middle step with saving data in file ? Thank you again. Ales

  • 08-07-2008, 8:20 AM In reply to

    • yellowdog.dave
    • Top 50 Contributor
    • Joined on 07-18-2008, 3:17 AM
    • Johannesburg, South Africa
    • Posts 66

    Re: Print summary

    Sure it is. Just work out your logparser query to get only the events you want from the appropriate event log, that would be something along the lines of this if your messages are in the Application log;

    LogParser "SELECT * FROM Application WHERE SourceName='BLAH' AND EventType = 8 AND EventCategoryName = 'BLAHBLAH'" -i:evt

    Play around with this until you have refined this and got only the events in which you are interested, then you can adapt the query I gave you to look something like this;

    select extract_token(EXTRACT_TOKEN( Message, -1, 'user' ),1,' ') as User,
    trim(extract_token(EXTRACT_TOKEN( Message, -1, 'on printer' ),0,'on port ')) as Printer,
    count(*) as Documents,
    sum(to_int(extract_token(EXTRACT_TOKEN( Message, -1, ':' ),1,' '))) as Pages
    from EventLog
    where SourceName='BLAH'
    and EventType = 8
    and EventCategoryName = 'BLAHBLAH'
    group by User, Printer 

    and run it like this;

    logparser file:print.sql -i:evt

    Obviously replace the bolded portions with your own criteria.  You may not need to use more than one criteria if your logging application is definitive enough.

    When you have got this right, then you can play with the output format options to insert this straight into a text report, CSV, XML, datagrid, database or whatever takes your fancy. 

    Yes, dear
  • 08-07-2008, 8:39 AM In reply to

    • yellowdog.dave
    • Top 50 Contributor
    • Joined on 07-18-2008, 3:17 AM
    • Johannesburg, South Africa
    • Posts 66

    Re: Print summary

     Hi Ales,

    Sorry, didn't see that you had said that the log was System and source Print. I presume that they are all the info messages in the example below;

    select extract_token(EXTRACT_TOKEN( Message, -1, 'user' ),1,' ') as User,
    trim(extract_token(EXTRACT_TOKEN( Message, -1, 'on printer' ),0,'on port ')) as Printer,
    count(*) as Documents,
    sum(to_int(extract_token(EXTRACT_TOKEN( Message, -1, ':' ),1,' '))) as Pages
    from System
    where SourceName='Print'
    and EventType = 2
    group by User, Printer 

    You can narrow the criteria further  using the rest of the fields available. Refer to logparser.chm for additional info and examples.

    Cheers, Dave 

    Yes, dear
  • 08-07-2008, 8:54 AM In reply to

    Re: Print summary

    Thank you, works fine. Final quest is to select events for whole previos month. Heading timestamp issues :) Thx Dave.

  • 08-08-2008, 7:24 AM In reply to

    Re: Print summary

    Hi, I am back Dave :) Now having problem with timestamp. I am trying this :

    select TimeGenerated, Message

    USING

    TO_LOCALTIME(TO_TIMESTAMP(TimeGenerated)) as TimeStamp,
        TO_STRING(TimeStamp, `hh`) AS Hour,
        TO_STRING(TimeStamp, `MM-dd-yyyy`) As LogDate,
        TO_STRING(TimeStamp, `dd`) As Day,
        TO_STRING(TO_LOCALTIME(SYSTEM_TIMESTAMP()), `dd`) As SystemDay,
        TO_STRING(SUB(TO_INT(SystemDay), 1)) As Yesterday


    from \\slim\System

    where EventID=10 AND (Day = Yesterday)

    but it return error code: Semantic Error: argument of function TO_TIMESTAMP must be a INTEGER or a REAL 

     Any suggestion ?

    Thank for help.

     

  • 08-08-2008, 9:46 AM In reply to

    • yellowdog.dave
    • Top 50 Contributor
    • Joined on 07-18-2008, 3:17 AM
    • Johannesburg, South Africa
    • Posts 66

    Re: Print summary

     Hi Ales,

    TimeGenerated in the event log is already a timestamp. You just need to convert it to local time; 

    TO_LOCALTIME(TimeGenerated) as TimeStamp

    Not sure what you are trying to do with the Using and all the rest, but hey, that's for you to figure out ;-)

    Good Luck. 

    Cheers, Dave 

    Yes, dear
  • 08-25-2008, 9:11 AM In reply to

    Re: Print summary

    Hi Dave,

    I am trying to needed information over desired time, etc for last whole day or last whole month.

    Cheers

  • 08-27-2008, 6:38 AM In reply to

    • yellowdog.dave
    • Top 50 Contributor
    • Joined on 07-18-2008, 3:17 AM
    • Johannesburg, South Africa
    • Posts 66

    Re: Print summary

    Hi Ales, 

    There is an example of how to subtract 2 days from current system time in the logparser.chm

    SUB( SYSTEM_TIMESTAMP(), TIMESTAMP('3', 'd') )

    Similarly, you can look at the Timestamp Format Specifiers section in the manual and do the same for a minute, hour, day, month, year etc. Similarly you can add to the date and also format your dates to be any of the formats you want.

    Cheers, Dave
    Yes, dear
Page 1 of 1 (10 items)
Page view counter