Export-CUQuery: Troubleshooting Outlook Crashes and Cleaning Results in Excel?

A user asked questions about using Export-CUQuery to filter Outlook crashes and problems – Wouter replied suggesting running the query on different monitors and checking data types. It was suggested that the events are kept in the monitor in-memory database for 60 mins by default.

Read the entire ‘Filtering Outlook Crashes and Problems with Export-CUQuery’ thread below:

Hello, I am starting to use Export-CUQuery and I have a couple of questions.

Wouters replied to some of them, but I don’t want to bother him alone… 😉

Here it is :

1. I am looking to do some stats about the Outlook crashes and problems we are gettings. When I use the Events tab of the OPConsole, I see 60 events with Event ID 1000 and message containing Outlook. When I run this : Export-CUQuery -OutputFolder xxx -Scheme Main – Table Events -Where "EventID = ‘1000’" or this : Export-CUQuery -OutputFolder xxx -Scheme Main – Table Events -Search EventID -Where "Message = ‘*Outlook‘"* I get only a few records. What I am missing?
2. What method do you then use in Excel to clean the results?

Thanks in avance, cheers, JCM

Events are held in RAM inside the console and on a per console basis. Knowing this it may be that only the monitor that is connected to that agent will have this data in memory so the query may only output the events for the machines its connected to. Theory… As a test you could run the command on another monitor and see if you get different results. If so you’d need to run the command on all monitors and aggregate the results.

Thanks @member for your answer.

I am running the cuquery on one of my console server which is also a monitor.

It has all the data souces and the other monitor has none.

There is no other console running currently.

Events are kept in the monitor in-memory database for a short time. Having said that, can you run the query without filters and see if the events are in the table at all?

I’m not sure if data types matter. IE ‘1000’ is different than 1000. Powershell generally doesn’t care about data types. But C#, which the monitors run, does.

the events are only held for 60 mins by default if i remember right could this be your issue

Thanks for your answers.

Continue reading and comment on the thread ‘Export-CUQuery: Troubleshooting Outlook Crashes and Cleaning Results in Excel?’.  Not a member? Join Here!