FROM

Log Parser

FROM

<from_clause> ::= FROM <from_entity>

The FROM clause is used to specify the input format source(s) from which the query input records are to be read.


Remarks:

  • The syntax and interpretation of the <from_entity> specified in the FROM clause depends on the input format used. For information on the syntax and interpretation of the <from_entity> values supported by each input format, refer to the Input Formats Reference.
  • Regardless of the input format used, the <from_entity> specified in the FROM clause must comply with the following general syntax:
    • The <from_entity> must be a single element or a list of elements, separated by the ',' (comma) or ';' (semicolon) characters, as in the following examples:
      file1.txt
      file1.txt, file2.txt
      file1.txt; D:\file2.txt; file3.txt
      
    • Each element can not contain spaces, ',' (comma) characters, or ';' (semicolon) characters, unless the element is enclosed by the ''' (single quote) or '" (double quotes) characters, as in the following example:
      file2.txt, 'C:\Program Files\file3.txt', file4.txt
      
    • The following characters are considered parenthesys characters, and if they appear in an element, they must appear as well-formed pairs of opening and closing parenthesys:
      < > ( ) [ ] { }
      The following examples show valid from-entities containing parenthesys characters:
      entity<value>
      entity[value]value
      
      The following examples show invalid from-entities containing parenthesys characters:
      entity>value<
      entity}value
      entity(value
      
  • Any character (including illegal characters and non-printable characters) in a <from-entity> can be entered using the \uxxxx notation, where xxxx is the 4-digit hexadecimal representation of the UNICODE character, as in the following example:
    C:\Program\u0020Files\file3.txt
    
  • From-entities that represent names of files or directories are not allowed to contain the following characters, even when enclosed in quote characters or entered using the \uxxxx notation:
    tab carriage-return line-feed , ( ) " < >


Examples:

A. <from_entity> with the REG input format

The following example query reads input records from the registry using the REG input format:
SELECT *
FROM \HKLM\SOFTWARE

B. <from_entity> with the EVT input format

The following example query reads input records from the System and Security event logs using the EVT input format:
SELECT *
FROM System, Security


See also:

INTO

Basics of a Query
Input Formats Reference


© 2004 Microsoft Corporation. All rights reserved.