Hi There
Have just started to use logparser to play with some squid logs, any way am trying to accumulate records using groups and 'with rollup', it all looks ok...but when I look at the grouping I get something like
Hostname status_code percentage_of_all_Records
Host1 200 35
Host1 404 20
Host1 302 5
Totals 30 - At this point I would expect 60, however this value always seems to be exactly 50% of the accumulated total for the group
My query looks like this :
SELECT EXTRACT_TOKEN(URI,2,'/') as HostName, EXTRACT_TOKEN(Result_Code, 1,'/') as HTTP_Code, Count(*) as Hits, to_int(MUL(100.0,PROPCOUNT(*))) as Percentage, count(*) as Hits, Grouping (HostName) as GHostName INTO %OUTPUT_DIR%HTTP_Codes.csv FROM %LOGS_DIR%access.log.4 GROUP BY HTTP_Code, HostName with Rollup order by HTTP_Code, HostName, GHostName Desc"
To me it seems that the rollup is doing something strange whenever a group end is encountered, though I have no idea what it's up to.
Any suggestions welcome.
Mart