Parsing Event Logs with Log Parser

I am trying to parse the event logs to a SQL table using logparser 2.1. What I am trying to do it is to parse hourly logs. Using the limited amount of help available thru the resources I have come up with the following 2 queries.( for testing purposes i am using DATAGRID instead of SQLSERVER )

LogParser "SELECT EventLog, RecordNumber, TimeGenerated, EventID, EventType, EventTypeName, EventCategory, SourceName, ComputerName, Message FROM Application TO tbltempevt WHERE TO_DATE(TimeGenerated) > TO_DATE(SUB(SYSTEM_TIME(), TO_TIME(TO_TIMESTAMP('01-00', 'hh-mm'))))" -o:DATAGRI

This gives me everything for the current date

Mike Gunderloy from logparser.com suggested this quer

WHERE SUB(SYSTEM_TIMESTAMP(), TimeGenerated) <= TO_TIMESTAMP('01-01:01','MM-dd:hh'

This doesn't give anythin

Any Help will be much appreciated.

Paul
Tue Feb 10 18:10:34 CST 2004

try this

"SELECT EventLog, RecordNumber, TimeGenerated, EventID, EventType,
EventTypeName, EventCategory, SourceName, ComputerName, Message FROM
Application WHERE TimeGenerated > SUB(SYSTEM_TIMESTAMP(),
TO_TIMESTAMP('01-00', 'hh-mm'))"

regards
paul

"KQ" <khurramq@yahoo.com> wrote in message
news:7704BEF7-7749-4EE7-83BB-C887E72BBD25@microsoft.com...
> I am trying to parse the event logs to a SQL table using logparser 2.1.
What I am trying to do it is to parse hourly logs. Using the limited amount
of help available thru the resources I have come up with the following 2
queries.( for testing purposes i am using DATAGRID instead of SQLSERVER )
>
> LogParser "SELECT EventLog, RecordNumber, TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName, ComputerName, Message
FROM Application TO tbltempevt WHERE TO_DATE(TimeGenerated) >
TO_DATE(SUB(SYSTEM_TIME(), TO_TIME(TO_TIMESTAMP('01-00',
'hh-mm'))))" -o:DATAGRID
>
> This gives me everything for the current date.
>
> Mike Gunderloy from logparser.com suggested this query
>
> WHERE SUB(SYSTEM_TIMESTAMP(), TimeGenerated) <=
TO_TIMESTAMP('01-01:01','MM-dd:hh')
>
> This doesn't give anything
>
> Any Help will be much appreciated.