Gather events from ULS log for specific correlation ID

  • Article

If you want to gather events from the ULS log that are marked with a specific correlation ID you can use the cmdlet Get-SPEventLog. Since you need to pass parameters to the cmdlet and need to format the output it might be much easier to apply some kind of alias for that command. To achieve that I create my own function and call that function with the correlation ID as a parameter. You can add that function for easier use to your PowerShell profile and make sure that you load the SharePoint PowerShell snapin.

The function will look like this:

function getlog { param ($corrID) Get-SPLogEvent | where {$_.Correlation -eq "$corrID"} | fl TimeStamp, Level, Message}

You can call that function like this:

getlog CorrelationID

If you do not like to create the function but like to do copy/paste you can of course simply copy the Get-SPLogEvent command from the function an paste the correlation ID to the where-equation.

In both cases the result should look similiar to this:

Sometimes this can be much easier than using the ULSViewer tool.