How to find uls log details based on correlation id using PowerShell in SharePoint 2016/2013

This PowerShell SharePoint tutorial explains, how to find uls log details based on Correlation ID from ULS Logs in SharePoint 2013/2016 using PowerShell.

This command will be very much helpful if you are working with multiple servers that are load balanced. Usually, logs file will be too big and to get log details for a particular Correlation ID is difficult for multiple servers.

If you are new to PowerShell, read an article on Working with PowerShell in SharePoint Online/2016/2013.

Whenever any error occurs in any SharePoint page, SharePoint through an error saying Something went wrong and then it will display a correlation id.

A correlation ID in SharePoint is like a unique GUID generated at the time of a request in SharePoint. Each correlation ID is unique to each request on a SharePoint farm.

PowerShell Script to Find ULS Log details based on Correlation ID in SharePoint

Below is the PowerShell command which will pick the error details for the particular Correlation ID from all the servers to a single place.

You can run the PowerShell command using Windows PowerShell ISE or using Visual Studio Code.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"
Merge-SPLogFile -Path "E:\Bijay\TempError.txt" -Correlation ff3a479d-8e3b-a03f-6251-ce47ef2463c6 -Overwrite

Make sure you have write access to the E:\Bijay\ folder.

Once you run the command, it will pull the logs from all the servers and it will write in the text file.

Similarly, also you can use get-splogevent command to retrieve logs based on the correlation id.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"}

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

Get-SPLogEvent -StartTime YYYY-MM-DDTHH:mm:ss | ?{$_.Correlation -eq "3eb6479d-c31e-70c8-65fd-37f3a9241469"} | select Area, Category, Level, EventID, Message | Format-List

You can also use the below command if you are trying in your local system rather in load balancer servers.

Add-PSSnapin "Microsoft.SharePoint.PowerShell"

get-splogevent | ?{$_.Correlation -eq "da80689d-e397-70c8-65fd-34a7bc8a5446"} | select Area, Category, Level, EventID,Message | Format-List > E:\errorlog.txt

Merge-SPLogFile in SharePoint 2010/2013/2016

Merge-SPLogFile cmdlet combines trace log entries from all farm computers into a single log file on the local computer. You can run this command from PowerShell.

This will be very much helpful if you are working in a multi-server environment. As SharePoint maintains log entries in each server, by using this command you can pull them in a single file.

You can filter based on various criteria like StartTime and EndTime, Process, Area, Category, EventID, and Message etc.

Below is the full syntax according to Microsoft.

Merge-SPLogFile -Path <String> [-Area <String[]>] [-AssignmentCollection <SPAssignmentCollection>] [-Category <String[]>] [-ContextFilter <String[]>] [-Correlation <Guid[]>] [-EndTime <DateTime>] [-EventID <String[]>] [-ExcludeNestedCorrelation <SwitchParameter>] [-Level <String>] [-Message <String[]>] [-Overwrite <SwitchParameter>] [-Process <String[]>] [-StartTime <DateTime>] [-ThreadID <UInt32[]>]

Below are some example which will be helpful:

Example-1:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite

Example-2:

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Area Search

Example-3: (merges the log data of level High or higher)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -Level High

Example-4: (merges based on a Correlation ID)

Merge-SPLogFile –Path "S:\SPLogs\MergedLogs.log" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite

Example-5: (Based on Time)

Merge-SPLogFile -Path "C:\Logs\FarmMergedLog.log" -Overwrite -StartTime "06/09/2008 16:00" – EndTime "06/09/2008 16:15"

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file

While working with Merge-SPLogFile PowerShell command, you might came accross an error as: Cmdlet did not return any records in the log file. Check your time range or filters.

We run the below PowerShell cmdlet to retrieve error details from ULS logs.

Merge-SPLogFile –Path "E:\SPLogs\MergedLogs.txt" –Correlation 3ae2a6c0-da14-43a1-afda-5bb6bbff3d43 -Overwrite
Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file

Below is the solution you can try to solve the issue.

Open your SharePoint 2013 Central Administration and then click on Monitoring. Then in the Monitoring page click on “Configure diagnostic logging” in the Reporting section.

This will open the Diagnostic Logging page. Then check the checkboxes like below are click on OK.

Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file

You may like following SharePoint tutorials:

I hope this will be helpful to find uls log details based on a correlation id in SharePoint 2013/2016 using PowerShell. We also saw how to fix error Merge-SPLogFile Correlation ID Cmdlet did not return any records in the log file in SharePoint 2013.

free sharepoint training

SharePoint Online FREE Training

JOIN a FREE SharePoint Video Course (3 Part Video Series)

envelope
envelope

Bijay Kumar

I am Bijay from Odisha, India. Currently working in my own venture TSInfo Technologies in Bangalore, India. I am Microsoft Office Servers and Services (SharePoint) MVP (5 times). I works in SharePoint 2016/2013/2010, SharePoint Online Office 365 etc. Check out My MVP Profile.. I also run popular SharePoint web site SharePointSky.com

>