Question

I’m parsing some IIS server logs (with LogParser) and I’m having a little trouble creating a query that will give me the aggregate count of each type of browser (user agent).

Here is my query so far:

SELECT COUNT(*) as totalHits, CS(User-Agent) as browser
FROM E:\Logs\ex111101.log
WHERE (CS(User-Agent) LIKE '%ipad%' 
       OR CS(User-Agent) LIKE '%iphone%' 
       OR CS(User-Agent) LIKE '%blackberry%'
       OR CS(User-Agent) LIKE '%windows cs%'
       OR CS(User-Agent) LIKE '%android%')
AND cs-uri-stem LIKE '%.asp%'
GROUP BY browser
ORDER BY totalHits DESC

This givse me a list of user-agents like I want, and gives me a hit count for each group of browser:

Total Hits | Browser
467        | AndroidA 
45         | AndroidB 
23         | BlackberryC
233        | BlackberryD

What I want is THIS:

Total Hits | Browser 
512        | Android 
256        | Blackberry

Where All Android entries are counted and totaled under a generic Android row. In this case Total Hits for Android would be 467 + 45, Blackberry would be 233 = 33, etc.

From there I would want to provide a Percent column for each browser so I can represent the total hits as a percentage.

Any help is appreciated. Thanks!

*UPDATE

Followed the suggestion below but had to make a few tweaks in order for it to be executed correctly by LogParser. For some reason Log Parser didn’t like the LIKE keyword in the CASE statement. The following worked fine though:

select
case strcnt(TO_LOWERCASE(cs(user-agent)),'android') WHEN 1 THEN 'Android' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'ipad') WHEN 1 THEN 'iPad' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'blackberry') WHEN 1 THEN 'Blackberry' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'windows ce') WHEN 1 THEN 'Windows' else
case strcnt(TO_LOWERCASE(cs(user-agent)),'iphone') WHEN 1 THEN 'iPhone' 
ELSE 'Non-Mobile' End End End End End as Browser,
count(*) as TotalHits
from MYLOG
group by Browser
order by TotalHits desc

Answer 1

try

select
      case when cs(User-Agent) like "%android%" then "Android"
           when cs(User-Agent) like "%black%" then "Blackberry"
           when cs(User-Agent) like "%windows%" then "Windows"
           when cs(User-Agent) like "%iphone%" then "iPhone"
           else "Other" end as Browser,
      count(*) as TotalHits
   from
      YourTable.logFile
   group by
      Browser
   order by
      TotalHits desc

The group by and order by respect the ordinal column position instead of re-copying the entire case/when and count(*)… Since there’s only two columns, no problem…