Search code examples
iis-10logparser

LogParser 2.2 - returns unknown field errors from IIS logs

Trying to return when a user last logged on by using LogParser - like this

logparser "SELECT TOP 25 date, time, cs-username As User FROM c:\inetpub\logs\LogFiles\W3SVC1\* WHERE User = 'User Name'"

or like this

logparser "SELECT TOP 25 cs-username As User, COUNT(*) as Hits FROM c:\inetpub\logs\LogFiles\W3SVC1\* WHERE User =  'User Name' GROUP BY User"

But get errors like

WARNING: Input format not specified - using TEXTLINE input format.
Error: SELECT clause: Syntax Error: unknown field 'date'

or 

WARNING: Input format not specified - using TEXTLINE input format.
Error: SELECT clause: Syntax Error: unknown field 'cs-username'

Any idea what I am doing wrong? First time I have used this utility

Thanks

Solution

  • You need to explicitly specify the input format; in this case, add -i IISW3C to the command line. When you don't specify an input format, LogParser will try to guess one heuristically, but in your case apparently it fails to do so and chooses the "catch-all" TEXTLINE input format.

    You can see a list of the supported input formats by running LogParser -h.