Log Parser Studio V2 Updated (12/11/2013)

The latest bits for LPS 2.0 are now available. This update contains a number of small fixes and enhancements including the promised fix of enabling the "Use Double Quotes" option for IIS Advanced Logging. The latest bits and associated links are below.

 Download the latest version of LPS:



There is also the ability to query Dynamics CRM logs. The log type is listed as "CRMLOG" in LPS. For more information see the following link.



Change List

+ Added custom support for Dynamics CRM tracing.

+Added default backslash to iCheckPoint for CSV because null
crashes PS export for CSV.

+Fixed chart type dropdown focus issue.

+Rewrote InputFormat parsing so that we derive the actual
name instead of [name, {type}] etc.

+Enabled IISW3C double quotes for IIS Advanced Logging. *** (Update - There is an issue with this fix which is being investigated. In the interim please use the workaround found here.)

+Added Accept/Cancel buttons for Enter/ESC .

+Fixed PowerShell "tabs" param issue.

+Removed ValueFromPipeline from PS Script Template.

+Added Accept/Cancel buttons for Enter/ESC.

+Added cancel buttons/ESC functionality to format dialogs.

+Updated FunctionReference.html

+Added queries for ActiveSync Troubleshooting Guide
Walkthrough (Ref: http://support.microsoft.com/common/survey.aspx?scid=sw;en;3616&showpage=1)

+Multiple small fixes/improvements/enhancements


Comments (26)
  1. Kary Wall says:

    I fixed, it, let’s hope I didn’t break it without realizing it. Let me go back and do some testing and I’ll follow up. Can I assume that you have "use double quotes" enabled now and it still doesn’t work?

  2. Kary Wall says:

    Hi James,

    So you did enable “Use Double Quotes” in the properties for the IISW3LOG type? Last time I tested this worked with Advanced Logging. If you are still having issues there is a workaround here that you can try while I investigate:


  3. Anonymous says:

    I would love to see intellisense and the ability to export the query to the clipboard to paste into the command prompt. These are 2 of the features that I love in the Log Parser Lizard by Lizard Labs.

  4. Anonymous says:

    Couple of stupid questions:
    1) where is the “FunctionReference.html” file located
    2) How do you display your “Favorite” queries?

  5. Kary Wall says:

    For the CRM tracing, I alerted the author of that component to see if they have any further info.

  6. Kary Wall says:

    FunctionReference.HTML = SHIFT+F3

    For favorites: Options > Preferences > Enable legacy category buttons – Restart LPS. Favorites is the Star shaped button on the far right. You can also find the function reference in the LP 2.2 .CHM in program file (x86)Log Parser 2.2

  7. Kary Wall says:

    Hi Steve, we have typically been using the case statement. See “Active Sync Report” query to see just how long these can be and still work quite well (other than the time it takes to enter them). If I find a better method I’ll update.

  8. Kary Wall says:

    Hi Bjorn,

    Creating a custom type is possible but it would have to be compiled into LPS before it would see it. You can however, use TextLine Log Type and do some pretty fancy stuff. If you press Shift+F12 in LPS you’ll get LP 2.2s function list which you can use to dig
    out just about anything you want.

  9. Anonymous says:

    Hi Kary.

    I apologize if I missed it, but is there a place where we can report bugs, other than as a comment on your blog?

    For example, I get the following error:

    Log Parser Studio
    Error parsing query: Semantic Error: presence of field(s) and aggregate function(s) in the SELECT clause with no GROUP BY clause [SQL query syntax invalid or unsupported.]

    New Query


    When running the following query:

    /* New Query */

    SELECT top 100 TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)) AS [LocalTime],c-ip, count(*)
    where cs-uri-stem like ‘/asdf/%’
    and cs-uri-stem not in (‘/asdf.aspx’)
    and EXTRACT_EXTENSION(cs-uri-stem) NOT IN (‘jpg’;’png’;’gif’;’ico’;’css’;’js’)
    and cs-uri-stem like ‘/asdf%’
    and cs-method = ‘POST’
    — comment
    group by LocalTime, c-ip

    Removing the comment about the group by clause causes the query to run without issue.

    I was also helping someone with a query and ran into another odd bug that I would like to report.


  10. Steve says:

    wish I had seen your post for ‘tips and tricks’ before I wrote my own for getting url parameters from the cs-uri-query
    SUBSTR( EXTRACT_TOKEN(cs-uri-query, 1, ‘&hf=’) , 0 , INDEX_OF( EXTRACT_TOKEN(cs-uri-query, 1, ‘&hf=’), ‘&’)) as HYPERFINDID,
    your solution sure looks easier…EXTRACT_PREFIX(EXTRACT_SUFFIX(FieldName, 0, ‘StartChar’), 0, ‘EndChar’) as FieldAlias
    One item that eludes me is how to do a vlookup type function when I have a list of ID’s for example that I need to replace with a proper name, and the list is too long to put into a case statement. This can be seen with user-agent strings that it would be great to have a xml file, that could return a more ‘common’ description. In the example above, the hyperfind id’s could be a list of hundreds that I have the description name – pair values for.

  11. james says:

    Love the tool it’s been a life saver many times, but I can’t seem to get it to work with IIS Advanced Logging (Which I need to get the client IP because we’re behind a Netscaler Loadbalancer). I’m able to run the ActiveSync report if I copy the SQL to a file, modify the Log by removing the space before the date field, and running log parser from the command line.

    I also had to remove the sitename and s-ip fields to get it working properly, changing the double quotes doesn’t seem to help, and after running the query so many times I get a RPC_Server error.

    Is there a support forum I can post more details on the issues I’ve been experiencing

    Thank you,

  12. This tool rocks - CRM Trace Log - Awesome :) says:

    I love the CRM Trace plugin, it’s great. Can’t find a bit of documentation anywhere though. When I try and use power-shell or the command line I get CRMTraceLPExt is an unknown format. Any pointers please?

  13. Clay says:

    Hi, Last december, Kary wrote that LPS will support custom fields in IIS logs in the next version, but it seems that it still not works. Or do I something wrong? Thanks for help, Clay

  14. evan says:

    I’m also having problems given a custom field on my IIS advanced log. An update?

  15. Bjoern Graf says:

    First of all – great tool! I am curious though if it is possible to define my own log types. I am trying to develop a solution which will parse many proprietary log where errors sometimes span multiple lines which I would like to group somehow. I figure that the most logical solution would be to create a custom log type for each log I will be parsing – is this possible?

  16. James Bull says:

    LPS complains that I need to install .NET 4.0 when I launch lps.exe on my Windows 7 / .NET 4.5 environment. I have mandatory corporate apps installed that require .NET 4.5. My research tells me that 4.0 and 4.5 cannot run side by side. Are there any tweaks
    required to run LPS in a .NET 4.5 environment (perhaps I’ve missed something obvious)? Any workaround (short of running in a dedicated VM) would be appreciated.

  17. Kary Wall says:

    Hi James, I’m not sure why it would be complaining. I’m running it on .NET 4.5. They can’t run side by side but 4.5 should be able to run 4.0 apps.

  18. Sean Killeen says:

    Hi Kary — thanks for this tool and the posts about it! It’s a great resource. Is Microsoft / are you interested in potentially making this project open-source? I would love to understand the workings of this and see if I couldn’t contribute something
    as well. If you’re interested, shoot me an e-mail at SeanKilleen@gmail.com or on twitter at @sjkilleen.

  19. Matthew says:

    I am using log parser on an IIS Advanced Logging file using the w3C format. I have a custom field with the client header IP address. When I run my query i am getting the wrong fields returned to me. For example I query out s-computer name and I get cs-version
    instead. Any idea what’s going on and how I can fix it?

  20. Toke says:

    Just another voice for the issues with Advance logging. I couldn’t get the workaround to function properly with 2.2 (though I might not have tried hard enough). A shame as this tool seemed pretty much what I was looking for to generate some custom queries
    and have them generated some basic graphs. (I have programmed my own queries in LinqPad prior, but this seemed to same a lot of time.)

  21. Kary Wall says:

    @Toke, I’ve tested the workaround on a few occasions as recently as last week and it worked so I’m not sure what we are doing differently. There could be something you need that I didn’t test of course.

  22. Kary Wall says:

    @Matthew, The workaround requires a manual header file that determines the field names. Are we sure those are both correct and aligned in the proper order?

  23. johnny says:

    Percentage queries are not working in LogParser studio..
    MUL(PROPCOUNT(*), 100.0) as percent results in 0.000134957501882657

    When run from cmd line outside of the studio, the correct percentages are shown..
    Is this a bug?

  24. Kary Wall says:

    Hi, Johnny.

    Can you tell me what is wrong with the percentage you posted? What should it have been? Of the times I have used PROPCOUNT in LPS I haven’t seen an issue unless I’m unaware of what the issue is.



  25. Kary says:

    Hi James,

    I’m not sure I understand. Anytime you use an aggregate function, in this case Count(*), you must include all non-aggregate fields, in this case c-ip and LocalTime in the GroupBy clause.

    In the above query –comment tells LPS to ignore it and everything that comes after it hence the wording of the error. What am I missing?

    Feel free to report anything you wish in this article and I will reply as soon as I can.


  26. Kary Wall says:

    Functions such as Count(*) Require group by for each field that isn’t a function.



Comments are closed.

Skip to main content