Search results matching tag 'TEXTWORD and TEXTLINE input formats'

Word count from text file as lexically correct

cci — Mon, 27 Apr 2009 10:38:44 GMT

Can the SQL statement for the Textword input be so specified that you can obtain or "obtain" or 'obtain' a word count without regards to punctuation, i.e. the word obtain would be counted 4 times rather than 2. Stan

TEXTLINE: <CR><LF> and just plain <CR>

brinkcm — Mon, 13 Oct 2008 18:10:29 GMT

Sorry if this comes across odd, I can't figure out this text editor.

Is there any way to change the delimiting character using TEXTLINE? For instance, the text file has:

Text<CR>

<CR>

More text<CR>

Notepad and Logparser show one blank line between the two lines, but a few editors I use show them as three. I don't think Logparser's doing it wrong, but I'd like to be able to change how it treats those characters. Should I run the text file through some utility that converts CR/LFs to something else? Or just the CRs? I proudly label myself a geek, but I have to admit I've never played with CR/LF much beyond stripping or inserting them en masse via text editor. I can't alter what's in the log file so I need to work around it. I'm comparing one line to another (ie, if X then return the line 6 lines above).

Thanks all.

EDIT: Found this in the patent submission. Yay for Google!

http://www.freepatentsonline.com/y2004/0254919.html

[0137] TEXTLINE: The Text field of this input data format is represented by any single line (separated by CRLF or CR) in the text file.

If I have CRLF, CR, CRLF it should by this web page be processing them as three blank lines. Bug? Misinterpretation?

Custom Log File unknown format

akentanaka — Thu, 11 Sep 2008 08:48:48 GMT

Hi,

I have no luck with the log that I'm trying to parse. I'm new to this world of log parsing and my initial thought to parse our custom log (below) is to use TSV but I can't seem to understand how EXTRACT_TOKEN works.

Below is a sample of our log file.

10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
An error occurred that triggered compensation:
Summary: Execution failed.

Caused by:
   Summary: no peer with a running instance of WorkFlowAnalyzer found
10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts:Module[3]:SubModule[2]:Utilities:MyModule[7]] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
The process started.
10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
Adapter request
[adapter request=
<request-data>
<my-action>
    <fields>
      <field>Description</field>
      <field>Detailed_Description</field>
      <field>Reported Source</field>
      <field>Requester Full Name</field>
    </fields>
</my-action>
</request-data>]

It appears that it has 6 parts

1) The date part

2) [Current Time=

3) [Process Name=

4) [Root Job Id=

5) [Job Id=

6) Log message

How can I break the log into 6 columns? I might use Log Parser Lizard to analyze the log file.

Thanks for your help!

Readline or instr type syntax required...i think(?)

LogParser User : marcus — Wed, 27 Jun 2007 14:59:00 GMT

Hi ,

I have the following permission dump:

\\server\mig_shared\ (P) -------------------------------------------
    [S-1-5-21-1992932873-789336058-839522115-1013]: RWXD-/RWXD-/RWXD-
    Administrators:                                  RWXDPOF-/RWXDPOF-/RWXDPOF- (owner)
    Users:                                           RX-/RX-/RX-

\\server\mig_shared\#ARCHIVE\ ---------------------------------------

\\server\mig_shared\#ARCHIVE\ERAS2000\ ------------------------------

\\server\mig_shared\#ARCHIVE\ERAS2000\Bde32\ ------------------------

\\server\mig_shared\#ARCHIVE\ERAS2000\Bde32\DISK1\ ------------------

\\server\mig_shared\#ARCHIVE\ERAS2000\Bde32\DISK2\ ------------------

1.) For the lines containing only the permissions, i'd like to prefix the path for which they have been reportedly applied to - as follows:

\\server\mig_shared\ (P) -------------------------------------------
\\server\mig_shared    [S-1-5-21-1992932873-789336058-839522115-1013]: RWXD-/RWXD-/RWXD-
\\server\mig_shared    Administrators:                                  RWXDPOF-/RWXDPOF-/RWXDPOF- (owner)
\\server\mig_shared    Users:                                           RX-/RX-/RX-

2.) I'd like to strip the paths or denote the permission paths with a character in the output so i can perform a second query just returning these results.

Any ideas how i can achieve this with logparser?

Thanks

Marcus

Logparser limiation with Textline, Unicode and CheckPoint

LogParser User : glenn_goodwin8 — Wed, 23 May 2007 06:35:00 GMT

Hello,

I have a LogParser query which I run across an ASCII and UNICODE file (2 files in total). Unicode file has FF FE for the first characters when viewed in HEX dump.

LogParser.exe "select EXTRACT_FILENAME(LogFileName), text FROM 'C:\*.log' where text like '%%Job Successful%%'" -i:TextLine -oataGrid

I get 2 results returned which is as expected. When I run the same query with a CheckPoint file I only get the ASCII record returned.

LogParser.exe "select EXTRACT_FILENAME(LogFileName), text FROM 'C:\*.log' where text like '%%Job Successful%%'" -i:TextLine -oataGrid -iCheckPoint:"C:\checkpoint.chk"

Is there a limitation with LogParser, Unicode and CheckPoint files?

Thanks
Glenn

RE: Extracting more than one line from a textfile

LogParser User : andru_nl — Thu, 03 May 2007 08:09:00 GMT

Eventually, any log files contain the lines that are related to each other.

Every log parsing task i had so far, I encountered the need to "sneak peek" couple of lines ahead, treat 2 or more lines as a single event, process a line1 if a line2 was found before, otherwise ignore, etc.

I implemented it so far using the state machines, but that is a complicated and not optimal solution.

You refer to "better suited platforms". Any chance that you tried to solve the same problems before me? Are there a generic patterns/algorithms for that?

RE: Need to pull pairs of lines from text file.

LogParser User : DEinspanjer — Wed, 25 Apr 2007 10:09:00 GMT

[QUOTE User="LogParser User : DEinspanjer"]Quote: Performance will most likely degrade severely on large files, but using SQL IN gets the job done ... select Index,Text from YourData.txt where Index in ( SELECT add(Index,1) FROM Yo...[/QUOTE]
That's a good idea Big J. I'd be interested to know how it performs on a bigger file.

I guess I didn't think about an IN subselect as a solution because I overlooked the fact that he only wanted rows pertaining to one person. I was thinking more along the lines of joining all the data rows with their associated names.

Descending untyped strings

LogParser User : nyuk — Tue, 24 Apr 2007 07:56:00 GMT

My TXT-log:

2003-05-19 10:31:45 DROP UDP 10.68.6.5 255.255.255.255 2285 8087 68 - - - - - - -
2003-05-19 10:31:55 DROP UDP 10.68.6.5 255.255.255.255 2287 8087 68 - - - - - - -
2003-05-19 10:35:15 DROP UDP 10.68.6.5 255.255.255.255 2263 8087 68 - - - - - - -
2003-05-19 10:38:25 DROP UDP 10.68.6.5 255.255.255.255 2281 8087 68 - - - - - - -
00067! 2003-05-19 10:33:53 { 2} ! [00/0] CLOSE: Single side disconnect request arrived |
00068* 2003-05-19 10:33:53 { 2} Total In Bytes:
00069* 2003-05-19 10:33:53 { 2} Total Out Bytes: 12 Kb

...

I want to rewrite strings by time as DESC. How ?

Thank You.

RE: Need to pull pairs of lines from text file.

LogParser User : nyuk — Tue, 24 Apr 2007 06:22:00 GMT

Thanx BigJ !!!!

TSV ==> SYSLOG

LogParser User : NewGuy — Fri, 06 Apr 2007 08:20:00 GMT

Hello,

Could anyone help me convert this TSV file format...

14/06/06 00:01:35 : C600 Initialisation : PO VISUALISATION
14/06/06 01:14:25 : C403 Peripherique hors ligne : Liaison TAF 1 Periph GC@PRS@DB
14/06/06 01:14:38 : Cmde PO7    : TIMEOUT
08/02/07 00:00:29 : C409 Erreur port de communication : Liaison TAF 5
08/02/07 00:00:31 : C403 Peripherique hors ligne : Liaison TAF 5 Periph VK_Q.1
08/02/07 00:02:40 : ATRE : Obs. AOBSBRO011170889359789150502150502
68137900A08/02/2007 00:02:39+0000            08/02/2007 00:02:3908/02/2007 00:02:40
77235000P08/02/2007 22:36:07+0001            08/02/2007 22:36:0508/02/2007 22:36:05

To SYSLOG format...

Any help would be greatly appreciated.

Nono