Tip: SharePoint Correlation ID PowerShell Locator

Cover Image for Tip: SharePoint Correlation ID PowerShell Locator

I can't count the number of times I've found myself hunting down a SharePoint Correlation ID on a multi-server SharePoint farm. If you've been there, you know exactly what a pain it can be. Even with ULS Viewer tools, locating each log file and consolidating all associated log entries into a single text file can be time consuming.

Assuming you have SharePoint Shell Access, one simple way to deal with this mundane task is to use the Merge-SPLogFile PowerShell cmdlet. Set up your command, execute, step out for a quick cup of coffee, and return to a text file filtered for your desired Correlation ID or start and stop date times from all SharePoint servers in a farm.

Here are some examples:

Example 1: Use Correlation ID ​Merge-SPLogFile -Path "D:\temp\correlationlog.txt" -Correlation 29b5c483-c48b-4ef2-b4b3-f5e29f635d31

Example 2: Use StartTime and EndTime Merge-SPLogFile -Path "D:\temp\timelog.txt" -Overwrite -StartTime "11/09/2015 16:00" - EndTime "11/09/2015 16:15"

Example 3: Need just the last hour? Merge-SPLogFile -Path "D:\temp\LastHourLog.txt" -Overwrite

You can also look for specific text, service application, area, level and/or user names!

Additional TechNet Documentation can be found here: https://technet.microsoft.com/en-us/library/ff607721.aspx