I have IIS log with extra field 'foo'.
#Fields: foo date s-sitename ...
foo1 2009-02-15 W3SVC1 ...
foo2 2009-02-15 W3SVC1 ...
As result all LogParser queries are broken:
logparser -i:IISW3C "SELECT c-ip, s-ip FROM my.log"
Statistics:
-----------
Elements processed: 0
Elements output: 0
Execution time: 0.00 seconds
Is it possible to inform LogParser about such extra fields, so it can parse IIS files?
Try W3C format (-i:W3C).
If that doesn't work and this is a one-time analysis, you could create a script to strip out that column. If this is an ongoing activity, you might want to consider using a standard format, or at least moving the extra field to the end.
By the way LogParser does support custom input formats.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With