title: Parse logs with SQL query to collect data in Log Parser Studio
body: <p>Excuse me for the question, my SQL knowledge is extremely limited. I'm trying to find anonymous connections in the exchange logs (I'm using Log Parser Studio which analyzes logs in bulk and parses them with SQL query). In the logs I see this:</p>
  
  <pre><code>#Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context
  2020-01-10T01:01:01.111X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,212,192.168.1.1:21111,192.168.1.2:5565,*,,Proxying inbound session with session id 01C1Z111DD1X11Z1
  2020-01-10T01:01:01.111X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,213,192.168.1.1:21111,192.168.1.2:5565,&gt;,RSET,
  2020-01-10T01:01:01.112X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,214,192.168.1.1:21111,192.168.1.2:5565,&lt;,250 2.0.0 Resetting,
  2020-01-10T01:01:01.112X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,215,192.168.1.1:21111,192.168.1.2:5565,&gt;,XPROXYFROM SID=08D7F721DC0D9A14 IP=215,192.168.1.1 PORT=21111 DOMAIN=CONTOSO.COM SEQNUM=1 PERMS=1077 AUTHsrc=Anonymous,
  2020-01-10T01:01:01.113X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,216,192.168.1.1:21111,192.168.1.2:5565,&lt;,250 XProxyFrom accepted,
  2020-01-10T01:01:01.113X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,217,192.168.1.1:21111,192.168.1.2:5565,*,,sending message with RecordId 151516 and InternetMessageId &lt;j6hd87fh-55h6-66h6-5g55-k9dj47gk704z@VM1203102312.contoso.com&gt;
  2020-01-10T01:01:01.113X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,218,192.168.1.1:21111,192.168.1.2:5565,&gt;,MAIL FROM:&lt;test@contoso.com&gt; SIZE=0 AUTH=&lt;&gt; XMESSAGEVALUE=MediumHigh,
  2020-01-10T01:01:01.113X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,219,192.168.1.1:21111,192.168.1.2:5565,&gt;,RCPT TO:&lt;receive@contoso.com&gt;,
  2020-01-10T01:01:01.115X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,210,192.168.1.1:21111,192.168.1.2:5565,&lt;,250 2.1.0 Sender OK,
  2020-01-10T01:01:01.115X,Inbound Proxy Internal Send Connector,01C1Z111DD1X11Z1,211,192.168.1.1:21111,192.168.1.2:5565,&lt;,250 2.1.5 Recipient OK,
  </code></pre>
  
  <p>So, I need to find data with "AUTHsrc=Anonymous" and then only show "IP", "MAIL FROM" and "RCPT TO" records from the session-id where "AUTHsrc=Anonymous" exists.</p>
  
  <p>I managed to create a query to list only those IDs I'm after:</p>
  
  <pre><code>SELECT * FROM '[LOGFILEPATH]'
  WHERE data LIKE '%AUTHsrc=Anonymous%'
  </code></pre>
  
  <p>But I don't know how to display other records based on my finding. I would assume I need a subquery?</p>
  
  <p><a href="https://i.stack.imgur.com/0qcXB.png" rel="nofollow noreferrer">picture for the reference</a></p>