[tools] Log Parser 2.2 is out

New Input and Output Formats:

XML Input Format

Reads XML files (requires the Microsoft® XML Parser (MSXML))

TSV Input Format

Reads tab- and space- separated values text files

ADS Input Format

Reads information from Active Directory objects

COM Input Format

Makes it possible to plugin user-implemented custom Input Formats

REG Input Format

Reads information from the Windows Registry

NETMON Input Format

Makes it possible to parse NetMon .cap capture files

ETW Input Format

Reads Event Tracing for Windows log files and live sessions

CHART Output Format

Creates chart image files (requires Microsoft Office 2000 or later)

TSV Output Format

Writes tab- and space- separated values text files

SYSLOG Output Format

Sends information to a SYSLOG server or to a SYSLOG-formatted text file

Improvements to the SQL Engine:

Exponential performance improvement in SELECT DISTINCT and GROUP BY queries

"WITH ROLLUP" functionality in the GROUP BY clause

"DISTINCT" in aggregate functions

(when no GROUP BY clause is specified)

"PROPSUM(...) [ ON <fields> ]" and "PROPCOUNT(...) [ ON <fields> ]" aggregate functions

(these functions calculate the ratio between the SUM or COUNT functions on a field and the SUM or COUNT functions on the same field in a hierarchically higher group)

New functions:

• MOD
• BIT_AND, BIT_OR, BIT_NOT, BIT_XOR, BIT_SHL, BIT_SHR
• EXP10, LOG10
• ROUND, FLOOR
• QNTROUND_TO_DIGIT, QNTFLOOR_TO_DIGIT
• STRREPEAT
• IN_ROW_NUMBER, OUT_ROW_NUMBER
• ROT13
• EXTRACT_FILENAME, EXTRACT_EXTENSION, EXTRACT_PATH
• HEX_TO_ASC, HEX_TO_PRINT, HEX_TO_INT
• HEX_TO_HEX8, HEX_TO_HEX16, HEX_TO_HEX32
• IPV4_TO_INT, INT_TO_IPV4
• HASHSEQ, HASHMD5_FILE
• EXTRACT_PREFIX, EXTRACT_SUFFIX
• STRCNT

Introduced a "USING" clause for declaring temporary field-expressions

"BETWEEN" operator in the WHERE and HAVING clauses

"CASE" (simple-form) statement in the SELECT clause

("SELECT CASE myField WHEN 'value1' THEN '0' WHEN 'value2' THEN '1' ELSE '-1' END")

New date and time formats:

• l (milliseconds - lower case 'L')
• n (nanoseconds)
• tt (AM/PM)
• ? (any character)

Fields and Aliases are now case-insensitive

Improvements to existing Input and Output Formats:

Added many new parameters to most of the Input and Output Formats

The NCSA input format now parses also combined and extended NCSA log files

Added "EventCategoryName" and "Data" fields to the EVT input format

The "-recurse" options of most input formats now specify a maximum subdirectory recursion level

The CSV Input and Output Formats now support CSV files with double-quoted strings

Added "FileVersion", "ProductVersion", "CompanyName", etc. fields to the FS input format

Allowed '*' and '?' wildcards in the site name specifications for all the IIS input formats

("SELECT * FROM <mysite*.com>")

Allowed URL's as the input path of all text-based input formats

("SELECT * FROM http://www.adatum.com/table.csv")

Allowed use of environment variable names in the TPL output format sections, and added a SYSTEM_TIMESTAMP variable

Performance improvement in the EVT input format when reading from local and remote event logs

All the property names of the input and output format COM objects now match the command-line names

General improvements:

Added the possibility to specify parameters in .sql files

( "logparser-file:myquery.sql?param1=value1+param2=value2")

Input I/O performance improvement for text files

Added the possibility to permanently override the default values of global options, input format options, and output format options

("logparser -e:10 -o:NAT -rtp:-1 -savedefaults")