search

davehull / Kansa

A Powershell incident response framework
Apache License 2.0
1.56k stars 266 forks source link

Analysis scripts fail (logparser syntax issue) #145

Closed Franky4fngers closed 8 years ago

Franky4fngers commented 8 years ago

Receiving Error: invalid parameter "fixedsep" on all "Net" analysis scripts. (likely others)

rschwass commented 8 years ago

Yeah i see it also. using log parser 2.2 I dont think that is a valid command.

dry-fly commented 8 years ago

It is valid for the TSV input type, just not for CSV, with LogParser 2.2. You can edit the analysis ps1 and remove the fixedsep parameter. You then also need to change the query to look for csv and not tsv files. It seems like the analysis ps1 scripts were changed to -i:csv but these two apparent corrections were left out? Not sure whether the get-logparserstack.ps1 is supposed to be a replacement. It seems that it could be a more generic analysis tool that could work on any data collection types, but currently lacks automation capability. I'm new to Kansa, just trying it out for the first time.

jt-msft commented 8 years ago

Fixed. Thanks for the report.