How to set date as a parameter when using Log Parser

Question

When using Log Parser, it actually support pass parameter to a sql file. In my case, I want set the output file name to contain today's date in format of yyyyMMdd. Here's my sql file content:

SELECT RecordNumber, TimeGenerated
  ,EventId,EventType,EventTypeName,EventCategory,EventCategoryName
  ,SourceName,REPLACE_STR(Strings,'\u000d\u000a','.') AS Strings
  ,ComputerName,SID,REPLACE_STR(Message,',','.') AS Message,Data 
INTO  C:\EventLog\Security_%date%.csv 
FROM Security
WHERE TimeGenerated > SYSTEM_DATE() 

And I call log parser from Windows power shell like :

.\LogParser.exe -o:CSV file:sqlfile.sql?date=.....

what can I put after "date=" so that I can get the current date in the format of yyyyMMdd?

Answer 1

LogParser will automatically use values from your SELECT statement to replace wildcards (*) in the INTO statement. So try adding this as the first field in your SELECT statement

TO_STRING(SYSTEM_DATE(), 'yyyyMMdd') AS [DateForFileName],

and change your INTO statement to

INTO  C:\EventLog\Security_*.csv

and you no longer need ?date=..... on the logparser.exe command.

/ Colin