Version 33 of LogParser goes COM

JM 7/4/2009, Using the LogParser's scriptable COM with Tcl:

Mode	Batch
Input	Windows Event Log
Output	CSV file
Mode	Batch Mode

 package require tcom
 console show

 set oLogQuery [::tcom::ref createobject "MSUtil.LogQuery"]

 set oEVTInputFormat [::tcom::ref createobject "MSUtil.LogQuery.EventLogInputFormat"]
 $oEVTInputFormat direction "BW"

 set oCSVOutputFormat [::tcom::ref createobject "MSUtil.LogQuery.CSVOutputFormat"]
 $oCSVOutputFormat tabs true

 set strQuery "SELECT TimeGenerated, EventID INTO C:\\output.csv FROM System"
 append strQuery " WHERE SourceName = 'Application Popup'"

 $oLogQuery ExecuteBatch $strQuery $oEVTInputFormat $oCSVOutputFormat

after running this example, the following file will be created:
c:\output.csv

Mode	Interactive
Input	Windows File System
Output	Tcl script itself
Mode	Interactive Mode

Interactive Mode - Example 1:
This example displays the 10 largest files on the C: drive:

 package require tcom
 console show

 set lgp [tcom::ref createobject MSUtil.LogQuery]
 set evt [tcom::ref createobject MSUtil.LogQuery.FileSystemInputFormat]

 set recordSet [$lgp Execute \
              "SELECT TOP 10 Path, Name, Size FROM C:\\*.* ORDER BY Size DESC"\
                   $evt]

 while { ![$recordSet atEnd] } {
      set record  [$recordSet getRecord]

      puts "[$record getValue 0],[$record getValue 1],[$record getValue 2]"

      $recordSet moveNext 
 }

 $recordSet close

Interactive Mode - Example 2:
filename of this script: TSV_parsing.tcl (so it serves as data to parse also) Also, There should be a <TAB> between each pair of the 5 lines of data shown below.

 if 0 {
 5        90
 25        30
 45        50
 65        55
 85        25
 }

 lappend auto_path .

 package require tcom
 console show

 set lgp [tcom::ref createobject MSUtil.LogQuery]

 set iTSVInputFormat [tcom::ref createobject MSUtil.LogQuery.TSVInputFormat]
 $iTSVInputFormat headerRow OFF
 $iTSVInputFormat nSkipLines 1
 $iTSVInputFormat fixedSep ON
 $iTSVInputFormat dtLines 5

 update
 set recordSet [$lgp Execute \
 "SELECT Field1 AS x,
 Field2 AS y FROM TSV_parsing.tcl
  WHERE IN_ROW_NUMBER() < 6 AND x>5"\
  $iTSVInputFormat]

 puts "Field names:"
 for {set i 0} {$i < [$recordSet getColumnCount]} {incr i} {
   puts "$i: [$recordSet getColumnName $i]"
 }
 puts "==========="
 while { ![$recordSet atEnd] } {
    set record  [$recordSet getRecord]
    #puts "[$record getValue customer]"
    set MaxColIx [expr [$recordSet getColumnCount] - 1]
    for {set i 0} {$i < [$recordSet getColumnCount]} {incr i} {
      if {$i < $MaxColIx} {
        puts -nonewline "[$record getValue [$recordSet getColumnName $i]],"
      } else {
        puts "[$record getValue [$recordSet getColumnName $i]]"      
      }
    }
    $recordSet moveNext
 }

 $recordSet close

male - 2010-02-23 - an example accessing the Windows event log LogParser accessing the Windows event log

Jorge - 2014-04-24 22:32:50