0

I am using Log Parser Studio 2.2 for constructing the usage profile for a user on Windows workstation. To find the user's log off time I want to check if a specific event 4798, logged in Security Event logs when a user logs off, coincides with the event 506, created in the System log when system enters standby. To do this I extract the 'Timegenerated' for a 4798 event and then see if that event falls within the time frame for a 506 event (within a 10-15 seconds range).

My problem is that the >= and <= operators aren't working (tested the code) when comparing the timestamps. What am I doing wrong here..could somebody point it out please?

Following is a snippet of my code:

SELECT DISTINCT timegenerated, EventID

USING CASE EventID When 4798 THEN EXTRACT_TOKEN(Strings,8,'|') End AS FilterValue

FROM Security

WHERE EventID = 4798

AND timegenerated >=
(SELECT LowerMark Using To_date(timegenerated) AS LogDate, Sub(To_time(timegenerated),timestamp('00:00:10','hh:mm:ss')) AS Lower, To_timestamp(LogDate,Lower) AS LowerMark FROM System WHERE EventID=506 ORDER BY LowerMark DESC )

AND timegenerated <= (SELECT UpperMark Using To_date(timegenerated) AS LogDate, Add(To_time(timegenerated),timestamp('00:00:15','hh:mm:ss')) AS Upper, To_timestamp(LogDate,Upper) AS UpperMark FROM System WHERE EventID=506 ORDER BY UpperMark DESC )
ORDER BY timegenerated DESC

MTaqi
  • 1
  • 1
  • LogParser does not support sub-queries in the WHERE clause - other than with the IN operator. Your best bet is to run this query as two stages - first get LowerMark and UpperMark, and then use these values via parameters in the second-stage query. – Gabriele Giuseppini Apr 11 '23 at 13:42
  • Thank you for the reply. Could you please explain a bit as to how I can do that in log parser? In sql I could have created stored procedures and called them, or thrown results in a table and do a join operation but this isn't possible in log parser I believe. – MTaqi Apr 12 '23 at 16:52
  • Indeed, you'll have to craft some batch script that runs the first query and gets the output values - for example by having the first query write LowerMark and UpperMark as a two-field single-line CSV and then read that CSV - and then pass LowerMark and UpperMark to a second query via parameters - see https://stackoverflow.com/questions/4563875/microsoft-logparser-how-to-use-parameters-in-a-file for details on using parameters. – Gabriele Giuseppini Apr 14 '23 at 07:48

0 Answers0