Home » Exchange Server » Using Log Parser's EXTRACT_PREFIX and EXTRACT_SUFFIX Functions to Split Strings

Using Log Parser's EXTRACT_PREFIX and EXTRACT_SUFFIX Functions to Split Strings

Exchange Server Pro forums member Nate-n8 has a question regarding Log Parser. Nate has a query returning certain strings that he wishes to truncate to only return the useful information for his report.

To demonstrate consider this query that is run against the RPC Client Access logs on an Exchange 2010 server.

What we get is a bunch of results that look similar to this:

Nate is only interested in the user name, ie “Alan.Reid”. So how do we return just that portion of the string with the Log Parser query?

The solution to this type of situation is in two functions available in Log Parser:


EXTRACT_PREFIX and EXTRACT_SUFFIX performs a similar function in a slightly different way, by letting you nominate a character as a separator and then the number (or instance) of that character where the string should be split.

  • EXTRACT_PREFIX splits the string at the specified instance of the separator (counting from the left-hand side) and returns the sub-string before (ie on the left-hand side of) the separator
  • EXTRACT_SUFFIX splits the string at the specified instance of the separator (counting from the right-hand side) and returns the sub-string after (ie on the right-hand side of) the separator

Which one you use depends on which side of the separator contains the sub-string you’re interested in. EXTRACT_PREFIX to the left, EXTRACT_SUFFIX to the right.

Example of EXTRACT_SUFFIX in Log Parser

For example, EXTRACT_SUFFIX in this case lets us specify “=” as the separator, which would make “Alan.Reid” the sub-string that exists to the right-hand side of the instance of the separator referenced as 0.

In the query itself it would be:

This returns a nice neat sub-string containing just the username information.

Example of EXTRACT_PREFIX in Log Parser

An example of EXTRACT_PREFIX is shown in my article on reporting top sender IP addresses using Log Parser and protocol logs.

EXTRACT_PREFIX is used here to separate the IP address from the port number of the remote endpoint that is logged by Exchange protocol logging.

The query in that example looks like this:


As you can see EXTRACT_PREFIX and EXTRACT_SUFFIX are two very useful functions in Log Parser that can help you turn a variety of strings into easy to read reporting data, and can certainly be used to solve Nate’s problem here.

Paul is a Microsoft MVP for Office Servers and Services. He works as a consultant, writer, and trainer specializing in Office 365 and Exchange Server. Paul is a co-author of Office 365 for IT Pros and several other books, and is also a Pluralsight author.
Category: Exchange Server

One comment

  1. Chris says:

    Great article, I ran into an issue when supplying multiple source log paths. It seems that the unique parameter was being applied per source so if usernames were in multiple source folders they would be returned in the results multiple times. To get around this I guess you need one source, or run another sweep over the result removing duplicates again. I’m new to log parser and it’s fairly frustrating in some cases, using -recurse for instance doesn’t work for csv..silly.

Leave a Reply

Your email address will not be published. Required fields are marked *