SELECT  

            TO_LOWERCASE (cs-username) AS User,

            SUM (MyGetAttachment)             AS Get_Attachments

USING 

            SUBSTR (cs-uri-query, ADD (INDEX_OF (cs-uri-query, 'Cmd='), 4), 

            INDEX_OF (SUBSTR(cs-uri-query, ADD (INDEX_OF (cs-uri-query, 'Cmd='), 4)), '&')) AS MyCmd,

            CASE MyCmd

                        WHEN 'GetAttachment' THEN 1

                        ELSE 0

            END AS MyGetAttachment

/* CSV 

If you want to output to CSV, you will need to add the cmd-line parameter -o:CSV

EXAMPLE: LogParser.exe -i:IISW3C -o:CSV file:c:\Public\LogParser\SQL\Get_Attachment_Hits_by_User.sql

*/


INTO C:\Public\LogParserOutput\Get_Attachment_Hits_By_User.csv


FROM C:\Public\Logs\*.log

WHERE cs-uri-stem = '/Microsoft-Server-ActiveSync'

GROUP BY User

ORDER BY Get_Attachments DESC