Total count of events different when retrieved directly from application and from command shell API

Total count of events different when retrieved directly from application and from command shell API

iamtulipin 1237869618|%e %b %Y, %H:%M %Z|agohover

I am working with SCOM Command shell API and I observed that total count of events different when retrieved directly from application and from command shell API.

Following is the command that I am executing:get-event

Total no of events that I got were 3018 however, from the application when I search using the 'Advanced Search' functionality the total no of events found were - 1904.

Can anybody tell me why is this difference? Any help will be greatly appreciated.

Re: Total count of events different when retrieved directly from application and from command shell API

marcoshaw 1237912970|%e %b %Y, %H:%M %Z|agohover

How exactly to you retrieve the count from the user interaface?

Re: Total count of events different when retrieved directly from application and from command shell API

iamtulipin 1238057516|%e %b %Y, %H:%M %Z|agohover

You can do search from Tools->Advanced Search. Then select the appropriate entity to search for.

Re: Total count of events different when retrieved directly from application and from command shell API

marcoshaw 1238158192|%e %b %Y, %H:%M %Z|agohover

The UI is only giving you the count from the last 24 hours by default, from what I can tell.

Try this instead:
PS>(get-event|where{$_.timegenerated -gt (get-date).addhours(-24)}).count

Still, I see a small difference: 190-ish in the UI vs 230-ish in the Command Shell.

I don't have time right now to try to figure out what's up…