LogParser 2.1 REPLACE_IF_NULL

[Andrew Aronoff]

I'm using LogParser 2.1 as a COM object under W2K SP4 via a VBS script
to analyse Event Logs. For any EventID, I'd like to show the
description ("Message") field if it's available. I'm having trouble
with a SysLog query that fails to return incidents that show in the
Event Viewer with the following description:

----------
The description for Event ID ( 43 ) in Source ( ATMhelpr ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event: .
----------

The following SQL string returns over 20 records:

SELECT EventID FROM System WHERE EventID = 43

The following SQL string returns error 80004005, "Recordset cannot be
used at this time [ Unknown Error ]":

SELECT EventID, REPLACE_IF_NULL(Message,'null value') FROM System
WHERE EventID = 43

I don't understand why the latter query doesn't run. What's the
correct query syntax to find events by EventID and include the message
field if it exists?

regards, Andy

**********

The X's have been added to my email address to thwart spam.
Take them out to reply.

**********

 

[Scot Wiedenfeld]

I'm using LogParser 2.1 as a COM object under W2K SP4 via a VBS script
to analyse Event Logs. For any EventID, I'd like to show the
description ("Message") field if it's available. I'm having trouble
with a SysLog query that fails to return incidents that show in the
Event Viewer with the following description:

----------
The description for Event ID ( 43 ) in Source ( ATMhelpr ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event: .
----------

The following SQL string returns over 20 records:

SELECT EventID FROM System WHERE EventID = 43

The following SQL string returns error 80004005, "Recordset cannot be
used at this time [ Unknown Error ]":

SELECT EventID, REPLACE_IF_NULL(Message,'null value') FROM System
WHERE EventID = 43

I don't understand why the latter query doesn't run. What's the
correct query syntax to find events by EventID and include the message
field if it exists?

regards, Andy

**********

The X's have been added to my email address to thwart spam.
Take them out to reply.

**********

I have not used LogParser yet (project for next month), for s&g have you
tried a LIKE query with the exact data you wish to retrieve?

WHERE EventID LIKE '43';

 

[Andrew Aronoff]

Hi, Scot.

Thanks for your suggestion.

have you tried a LIKE query with the exact data you wish to retrieve?

To retrieve exact data, an equal sign is much better than a LIKE.

Besides, a LIKE clause for EventID won't affect return of a null (or
missing) Message field; my question addresses retrieval of the Message
field contents.

regards, Andy

I'm using LogParser 2.1 as a COM object under W2K SP4 via a VBS script
to analyse Event Logs. For any EventID, I'd like to show the
description ("Message") field if it's available. I'm having trouble
with a SysLog query that fails to return incidents that show in the
Event Viewer with the following description:

----------
The description for Event ID ( 43 ) in Source ( ATMhelpr ) cannot be
found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote
computer. The following information is part of the event: .
----------

The following SQL string returns over 20 records:

SELECT EventID FROM System WHERE EventID = 43

The following SQL string returns error 80004005, "Recordset cannot be
used at this time [ Unknown Error ]":

SELECT EventID, REPLACE_IF_NULL(Message,'null value') FROM System
WHERE EventID = 43

I don't understand why the latter query doesn't run. What's the
correct query syntax to find events by EventID and include the message
field if it exists?

regards, Andy

I have not used LogParser yet (project for next month), for s&g have you
tried a LIKE query with the exact data you wish to retrieve?

WHERE EventID LIKE '43';

**********

The X's have been added to my email address to thwart spam.
Take them out to reply.

**********