Hi there, I am trying to pull the list of eventlogs from a remote machine using the following query: logparser "select distinct KeyName from \\ \HKLM\SYSTEM\CurrentControlSet\Services\EventLog where KeyName <> 'EventLog'" -i:reg On certain machines this seems to hang, is there a way to force a timeout...

Thank you so much for the help. When I saw "parse errors" and instructions about using "-e", I incorrectly assumed that the parsing had aborted (even though the output clearly states "Task completed with parse errors.") I am certainly glad that LogParser does a much better job at parsing text than I...

Yep, remove "-e", and all the parse errors will be ignored (you'll just get a "There have been XYZ parse errors" at the end). SAM keys can not be read by anyone other than System.

I tried to run a query on a computer at work on which I have local admintrator privileges. Apparently, there is some data that I do not have access to, as can be seen below: C:\Program Files\Log Parser 2.2>LogParser -e -i:REG -o:TSV "SELECT KeyName,ValueName,Value FROM \HKLM WHERE ( KeyName LIKE '%TDT...

Thanks!!!! You've found a bug!!!!!!!! The bug has been fixed now. In a couple of weeks we'll release an updated 2.2.10 version that will contain this fix (among a few others). Thanks a LOT for reporting the bug!!!!!!!!!!

Here you go... You'll need to rename the batchfile.txt to batchfile.bat as it wouldn't let me upload.

Can you post the file containing the NULL character and the full command you're using to generate the file?

If I view the results in a text editor (I'm using Textpad) I can see a null character at the end of each line that is a data type of REG_SZ, if I open the file in excel (as it's tsv) it just ignores it. The reason this is an issue for me is that the comparison tools I use against the resulting file sees...

Where do you see the NULL terminator?

Is it possible to supress the null character that is sometimes present in REG_SZ fields? Here's an example of what I'm doing: LogParser "SELECT Path, KeyName, ValueName, ValueType, Value FROM '\HKLM\Software\Microsoft\Updates'" -binaryFormat RINT -i:REG -o:tsv Thanks