Solved: Re: Log Apache analysis with QlikView - Qlik Community

Report Inappropriate Content · ‎2014-04-25

I have to analyze a log file of a portal and would like to use as a tool ClikView. The file has the extension. Log

The format of the log is to Apache and I should extract the information contained in it.

A sample of the file is as follows:

61432c789518088e2c708f122d260f9178b87059 - - [04/Mar/2014:06:25:04 +0100] "GET /page/Stig_Boqvist HTTP/1.1" 200 4561 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"

445fd14a49ff5469ed4ee51f5a2b6a7f5efea22b - - [04/Mar/2014:06:25:05 +0100] "GET /data/Waldkirchen.jrdf HTTP/1.1" 200 8612 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"

949d8c5d984bdbb6ca32364d80a4e2469e8a8e25 - - [04/Mar/2014:06:25:06 +0100] "GET /page/Homer_Dickenson HTTP/1.1" 200 4533 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

....

The information I want to know are:

- Content displayed more

- User agent used to make requests etc.

Basically I should be doing the business intelligence analysis on this log file. Can you help me or give me some suggestions?You can read the contents of the file and parse it directly? Taking for example the dashboard?

Thank you in advance for your reply

greetings

Carlo

Clever_Anjos · ‎2014-04-30

I´ve used this script

SET ThousandSep='.';
SET DecimalSep=',';
SET MoneyThousandSep='.';
SET MoneyDecimalSep=',';
SET MoneyFormat='R$ #.##0,00;-R$ #.##0,00';
SET TimeFormat='hh:mm:ss';
SET DateFormat='DD/MM/YYYY';
SET TimestampFormat='DD/MM/YYYY hh:mm:ss[.fff]';
SET MonthNames='jan;fev;mar;abr;mai;jun;jul;ago;set;out;nov;dez';
SET DayNames='seg;ter;qua;qui;sex;sáb;dom';

LOAD @1 as IP,
    date#(lower(mid(@4,2,11)),'DD/MMM/YYYY') as Date,
    mid(@4,14,11) as Hour,
    @5,
    @6 as Richiesta,
    @7 as Risposta,
    @8 as Payload,
    @9,
    @10 as UserAgent
FROM
[provalog.txt]
(txt, codepage is 1252, no labels, delimiter is spaces, msq);

View solution in original post

Gysbert_Wassenaar · ‎2014-04-25

Please don't post the same question twice.

talk is cheap, supply exceeds demand

Report Inappropriate Content · ‎2014-04-28

I'm sorry I was wrong. I'm new in the community.

Report Inappropriate Content · ‎2014-04-28

I would try Fixed Record , see image

Clever_Anjos · ‎2014-04-28

Use Fixed record in order to split your lines

Report Inappropriate Content · ‎2014-04-29

Thanks for the reply Cleaver now trying to do fixed record
Thanks for the support.

Carlo

Report Inappropriate Content · ‎2014-04-29

Thanks for the reply with graphic Amir. You have been very kind, now I try with fixed record.

Carlo

Report Inappropriate Content · ‎2014-04-30

Hi Amir,

I tried to record fixed but the size of the get is not the same for all requests and get cutting losing information:

To solve this problem I tried with delimited and I chose the space as a delimiter but then so I can not separate the date in day, month, year, as the format is day / month / year and does not include spaces.

Any suggestions? How do I separate the date in day, month, year, and at the same time do not get cut off the leaking information? I would need a fusion between record fixed and delimited

thanks
Carlo

Clever_Anjos · ‎2014-04-30

Could you post a sample of your log?

I´ll make it for you

Report Inappropriate Content · ‎2014-04-30

I am attaching the file to upload with QlikView. The tables at the end I would get are:

IP-address
day-
month-
-year
-now
user-agent
-request
payload-size
-server response

I would like to get something like the following figure, however, in addition to the tables of the day, month, year, hour

schema_tabella.JPG.jpg

Thank you very much, I'm grateful for the response