All Tags >
IIS Input Format (
RSS)
Sorry, but there are no more tags available to filter with.
-
-
If you remove the DISTINCT clause, you should be fine. SELECT User , Occurances USING TO_LOWERCASE(cs-username) AS User , COUNT(*) AS Occurances FROM ex060511.log GROUP BY User ORDER BY User
-
I'm trying to research a problem with authentication in my IIS logs...so I banged up this SQL: SELECT DISTINCT TO_LOWERCASE(cs-username), count (*) as Occurrances FROM ex060511.log GROUP BY cs-username ORDER BY TO_LOWERCASE(cs-username) As you can see in the results below, users often appear 2 or 3 times...
-
got it working using logparser -i:IIS "SELECT TOP 10 UserIP, COUNT(*) FROM h:\winnt\system32\logfiles\smtpsvc1\in0605*.log GROUP BY UserIP"
-
im trying to query my IIS logs to find out the top 10 mail servers that have connected to our mail server. SELECT TOP 10 UserIP, COUNT(*) FROM in0605*.log GROUP BY UserIP when i try the above command it returns : Error: detected extra argument "TOP" after query looking over the log parser documentation...
-
The problem was #1. I was running version 2.0. As soon as I upgraded the query worked beautifully. Thanks so much for your help!
-
Odd.. I copied your query and it runs fine against my IISW3C log source (I used instead of a direct reference to a file). A few troubleshooting questions/ideas: 1. Are you running LP 2.2.10? 2. Try wrapping all your field names in []. i.e. instead of cs(Referer) try [cs(Referer)] 3. Run the query with...
-
Thanks for your quick reply! Still doesn't seem to work... SELECT cs(Referer), cs-uri-stem, count (*) as Occurrances FROM d:\logfiles\w3svc4\ex060501.log WHERE sc-status = 404 AND time BETWEEN TIMESTAMP('14:32:46', 'hh:mm:ss') AND TIMESTAMP('15:00:42', 'hh:mm:ss') Group By cs(Referer), cs-uri-stem Generated...
-
the time field is not a string. it is a "time only timestamp" (type T). Use the TIMESTAMP() function to create time only timestamps that can be used to compare with the time field. e.g. AND time BETWEEN TIMESTAMP('14:32:46', 'hh:mm:ss') AND TIMESTAMP('15:00:42', 'hh:mm:ss')
-
I'm having difficulty figuring out how to run my query for a small window of time in my IIS logs. In the sample below I want to report all of the 404's in a 30 minute window (it works fine except for the time window): SELECT cs(Referer), cs-uri-stem, count (*) as Occurrances FROM d:\logfiles\w3svc4\ex060501...