How to view Windows Event Log using Log Parser Lizard

Microsoft Logparser and Log Parser Lizard are very power tools to query various data sources including Windows Event Logs. You don’t have to be expert programmer in order to write simple queries but it is desirable to have basic knowledge of SQL and its syntax. You can search for examples on the Internet on sites like this and this, and it will be good to read Logparser’s help which also has a comprehensive reference on query syntax. There are also a number of examples in Log Parser Lizard you should explore and play with. When you master writing queries you can write very complex queries for data analyses as you need.

Anyway here is a simple tutorial on how to use Log Parser Lizard:

1. Run the program and click on toolbar button “New Query”. A new query window will open.
2. Click on “Input Format” and select “Windows Event Log” (2nd one)
3. Write the query and click “Run Query” to get results.

Here are some sample queries to query event log:

Get all errors from system log (EventType=1)

select * from System where EventType=1

This query will filter all Events with EventID=1053 from Application Log

select TOP 100 * from application WHERE EventID=1053

And this query will prompt for input of EventID

select top 100 * from Application where EventID=<% return Microsoft.VisualBasic.Interaction.InputBox(“Please enter Event ID”,“Event ID”,“1053”) %>

This will count all grouped by Event Type. You can see a nice chart from this by clicking “Display Chart”

select EventTypeName, count(*) as [Number of events] from System group by EventTypeName

You can select logs from a file too:

SELECT * FROM ‘C:\logs\System.evtx’ WHERE EventType=1

In order to select event event logs on different server, you can write queries like this:


or to access multiple servers in one query, try this


The user that runs the query must have appropriate permissions to access event log (for instance, domain admin). Also not that you can’t parse Windows 7 evtx event files on Windows XP PC that supports only legacy evt log format and vice versa, you cant read evt log files on Windows 7.

I hope this was helpful and you will enjoy using Log Parser Lizard as many others do :)

Log Parser Lizard: FAQ

  1. How to use inline Visual Basic .Net code?
  2. Can I try Log Parser Lizard before I buy it?
  3. I own a previous version of Log Parser Lizard. Do you offer upgrade pricing from a previous version?
  4. How can I modify formula field?
  5. How do I download updates and upgrade?
  6. How do I enter my license code in Log Parser Lizard?
  7. How do I specify in the regex that I want to match something on the second line of the output?
  8. How to get user input for queries?
  9. How to view Windows Event Log using Log Parser Lizard
  10. I just wanted to find out what extra features are enabled after registering this product
  11. I purchased a license for Log Parser Lizard, but I can not find where to download it from. Please advise where it can be downloaded from.
  12. I want Log Parser Lizard GUI to be much better and I want to help. How to help?
  13. I was unable to download the Log Parse Lizard. What to do?
  14. I'm getting Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154 anytime I click on any of the options
  15. Is there a listing of example log queries beyond those listed in the UI?
  16. Who is using Log Parser Lizard?
  17. How to look at the logs of multiple servers?
  18. Can I use Log Parser Lizard to Query MS SQL, Oracle or My SQL database?
  19. My anti virus software is telling me it found security risk in LogParserLizard.msi
  20. Why am I getting an out of memory exception when I have more memory than is being used?
  21. I've ordered today but my license code not working
  22. Please can you send us a reseller quote for this license, and more important, is there a reseller discount available?
  23. Can I use Log Parser Lizard for Google BigQuery BigData services?
  24. I did not receive the confirmation email after requesting free trial. What should I do?

Feedback and Knowledge Base