SELECT MyDeviceType AS DeviceType, COUNT(*) AS Hits USING SUBSTR (cs-uri-query, ADD (INDEX_OF (cs-uri-query, 'DeviceType='), 11), INDEX_OF (SUBSTR(cs-uri-query, ADD (INDEX_OF (cs-uri-query, 'DeviceType='), 11)), '&')) AS MyDeviceType /* Output Types: 1) CSV, 2) Chart */ /* CSV */ /* INTO C:\Public\LogParserOutput\Hits_By_DeviceType.csv */ /* Chart */ INTO C:\Public\LogParserOutput\Hits_By_DeviceType.CSV FROM C:\Public\Logs\*.log WHERE cs-uri-stem LIKE '%ActiveSync' GROUP BY MyDeviceType