5

I have abc=1234 added to cookie.

It shows up in IIS log. But the cs(Cookie) field shows other cookies also separated by semicolon.

I want to use to get the value of cookie abc.

Can you please suggest a query?

e.g. if cs(Cookie) has value +pqr=999;+abc=1234;+xyz=222, the logparser query should return 1234.

Mahmoud Gamal
  • 78,257
  • 17
  • 139
  • 164
Souvik Basu
  • 3,069
  • 4
  • 28
  • 42

1 Answers1

6

Found it. Use the extract_value() function

logparser "SELECT extract_value(cs(Cookie),'+abc',';') as abc_value from ..."
Souvik Basu
  • 3,069
  • 4
  • 28
  • 42
  • Very good, but the first cookie is not preceded by a `+` so would be missed. Given this, `coalesce(extract_value(cs(Cookie), 'abc', ';'), extract_value(cs(Cookie), '+abc', ';')) as abc_value` will find the value, even if it's first in the list. +1 anyway. Thx. – spender Jun 15 '16 at 18:43