Historical Event Viewer: Is it possible to search for traces which are containing errors?

[Anon Anon]

Hello guys,

 

I am wondering if it is possible to search within the Historical Event Viewer for traces that do contain errors? I tried 'status:error', but it doesn't work. I used the 9.6 version for testing purpose. Do not have access to 9.7 right now.

 

Does anyone know it this is possible or if this functionality is/will be provided with a version?

 

Thanks in advance!

 

Greetings,

Matthias

[Haruhiko Davis]

type:errorsnapshot

[Anon Anon]

I want to see traces (type:trace) that are marked with the white cross in a red circle icon

[Haruhiko Davis]

Guenter_Grossberger

Can you possibly help on this question? I don't have much time to do research this week.

[Guenter DI Grossberger]

Unfortunately this is not directly possible.With the command line workstation (CLW) it is possible to create a script that first queries errors and then queries traces in the same timeframe.

 

Ciao,

Guenter

[Anon Anon]

Hello Guenter,

 

thanks for your response. Unfortunately, this is not a suitable solution since our users only use the WebView. The CLW is not something that these stakeholder group wants to deal with.

 

I still wonder if this functionality could be implemented easily by the product because in order to mark a transaction with the icon Introscope has already the information about a trace containing error. So why not provide this as a query parameter.

 

Greetings,

Matthias

[Legacy User]

The below query should do the trick:

 

+Error AND (type:sampled OR type:normal)

[Anon Anon]

Hello,

 

thanks for your response.

 

I tried it out but it doesn't work for me.

Query with type:sampled OR type:normal contains traces with error icon. But if I use your search the result set is 0.

I tried also a query only with '+Error' which results in type:errorsnapshot result set.

 

Any other idea?

 

Greetings,

Matthias

[Viruvaibhav_apm]

HI Matthias,

 

Please try -

(type:normal or type:sampled) AND +"Error"

 

Hope it helps.

 

Regards,

Vaibhav

[Anon Anon]

Hello Vaibhav,

thanks for your response.

 

Your query doesn't work. I tried all the below queries:

 

(type:normal or type:sampled) AND +"Error"

(type:normal or type:sampled) AND "Error"

+"Error"

+Error

"Error"

+"Errors"

"Errors"

+"Errors: 2" (thought maybe it works on the string which is shown when being with the mouse on the icon)

"Errors: 2" (thought maybe it works on the string which is shown when being with the mouse on the icon)

I really struggle in general with this kind of search. Most of the time it is not obvious what you have to insert to get what you want. It is more guessing and playing around until you get a result which might be the one you wanted to get.

Greetings,

Matthias

[Guenter DI Grossberger]

Hi,

 

I just tried "error and (type:sampled or type:normal)" and it just works.

 

Ciao,

Guenter

[Viruvaibhav_apm]

Sorry to say Matthias, but it is working perfectly fine at my end.

Initially I too had the same notion, but then jakbutler helped me to understand that it follows a Lucene Syntax which opened my way to understand and hit the correct queries as per my requirement.

 

Not sure why is it not working for you. !!

 

Regards,

Vaibhav

[Anon Anon]

Hello jakbutler, Guenter and Vaibhav,

 

I have repeated the your queries all today because I could not believe that your suggestions will not work for me. Today all your queries returned results. I even checked with the corresponding time window for the traces I tried to find yesterday. It worked!

 

It looks to me like the searches could not complete correctly yesterday. We had already some performance issue in the past.

 

Many thanks to all of you!

 

I had a looked for the lycene syntax at this site: Apache Lucene - Query Parser Syntax Do you have any other documentation you can share about searches in the Historical Event Viewer? Is there any official Introscope documentation available about the usage with some examples?

 

 

Greetings,

Matthias