Shout out to Bennis at Bayswater Electrical for this!
Logpaser is seriously good tool to filter through the mess of IIS logs!
Grab all your ISS log files for the dates you need.
Chuck them in a directory
First command grabs all the .log files into a single csv
logparser.exe -i:iis “select * into c:\temp\merge.log from c:\temp\logs\*” -o:csv
the “–i” option selects the log format be sure to select the correct format to match your IIS settings. eg, exchange is generally IISW3C.
The second command you use to filter out the details you really need, similar to a sql query!
logparser.exe -i:csv “Select username, date, time, target FROM c:\temp\merge.log TO c:\temp\output.csv WHERE RequestType LIKE ‘%get%’ and username is not null”
Use Excel or Notepad ++ to join the results together