This worked great! Thanks. When is 2.2 going to be out? Will 2.2 be able to parse NCSA extended/combined log format ?

That's an unfortunate bug in 2.1; it's already been fixed in the upcoming 2.2 release. The bug is in the TPL output format, when it formats a TIMESTAMP value. For the moment, you can TO_STRING() your timestamp expression, so that TPL won't have to format the TIMESTAMP value itself: "Select TO_STRING...

logparser -o:CSV "Select TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date,time), 3600)) AS zHour, AVG(time-taken) as AveTime, Min(time-taken) as MinTime, Max(time-taken) as MaxTime, Count(*) as HitCount from ex040603.log where time-taken > 1 group by zHour order by zHour" This works fine and gives results...

Hi, The problem is resolved now and you are correct I was not logging the cs-refferer field. cheers raz

May be your logs are not logging the cs(Referer) field? ------------------------------ This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

Hi, I am trying to use the tpl templates and it does not seem to be working for me. 1. SELECT DISTINCT cs(Referer) as Referer, cs-uri-stem as Url FROM c:\temp\logs\ex*.log TO Refer.html WHERE cs(Referer) IS NOT NULL AND sc-status=404 AND (sc-substatus IS NULL OR sc-substatus=0) 2. leave the ReferBrokenLinks...