Hi Guys,
This is a weird one, Im using logparser to work through some log files and present some output. The input to logparser is being created by some powershell scripts that Ive written to replace the existing batch files. Heres a sample of the original input files;
10.197.71.26 AU 03172009 23:59:59 21 116490096
As you can see the file is tab seperate appart from the date/time fields.
In my logparser commands Im using the following;
logparser.exe "SELECT Date, COUNT(*) INTO d:\scripting\logparser\oldoutput.txt FROM d:\scripting\logparser\oldinput*.log GROUP BY Date" -i:TSV -iSeparator:tab -headerRow:OFF -iHeaderFile:"D:\scripting\logparser\header.tsv" -lineFilter:"+10.176.71.30" -iTsFormat:"MMddyyyy" -o:CHART -chartType:ColumnClustered -config:MyScript.js -chartTitle:"History"
the iheaderfile looks like this;
IronIP Country date type MSGID
This all works fine and results in a text file with the following;
date,COUNT(ALL *) 2009-03-18,22 2009-03-17,2
As you can see the date field has been converted to a timestamp thanks to -iTsFormat:"MMddyyyy" in the logparser command.
The problem occurs when I switch to using my ps script to generate the input for logparser, which result in the following space seperated input file;
10.197.71.26 AU 03172009 23:59:59 <sender@dfc.sa.gov.au> <recipient@kpmg.com.au']>
I modify my iheaderfile as follows;
a b c d e
and my logparser command changes to; logparser.exe "SELECT c, COUNT(*) INTO d:\scripting\logparser\newoutput.txt FROM d:\scripting\logparser\newinput*.log GROUP BY c" -i:TSV -iSeparator:tab -headerRow:Off -iHeaderFile:"D:\scripting\logparser\test.tsv" -lineFilter:"+10.197.71.26" -iTsFormat:"MMddyyyy" -O:CSV
This then results in the following output
c,COUNT(ALL *) 3172009,15
As you can see the date field hasnt been corrected convered to a timestamp as in my previous example. Logparser seems happy if the date and time are presented as a single item in the header file but in my second example when the input file is entirely space seperated I see problems.
Obviously I can hack my way around and alter the output that powershell is providing to logparser but I would like to fix it properly.
Any ideas guys? Appologies for the wordy question!!
Andy