Get-ScomAlert does not return previous 3 hours of data

Hi Guys!

I have a one liner script that is supposed to query certain user account locked out alerts in the last 12-hours, every time I run the command, it does not return the locked out alert for that certain user in the last 3 hours, actually the behavior is the same for any user that I query.

For example, if I run the script at 1:00:PM, it will only return data up to 10:00AM in the morning.

I think the issue is global because even for other alert, if I query using the same script, the result is the same.

What I would like to achieve is display all alerts for this user up to the current date/time, within the 12 hours period.

Below is my one liner script:

Get-SCOMAlert -Criteria “ResolutionState = ‘0’ AND CustomField1 like ‘John.Doe’ ” | where {$.TimeAdded -gt (Get-Date).addhours(-12)} | Select @{Name=”Date”;Expression={$.TimeAdded}},@{Name=”Username”;Expression={$.CustomField1}},@{Name=”AccountLockedOutSource”;Expression={$.CustomField2}}

Thanks!

I already fixed the issue after converting the TimeAdded from UTC to local time, below is the correct code:

Get-SCOMAlert -Criteria “ResolutionState = ‘0’ AND CustomField1 like ‘John.Doe’ ” | where {$.TimeAdded -gt (Get-Date).addhours(-12)} | Select @{Name=”Date”;Expression={$.TimeAdded.ToLocalTime()}},@{Name=”Username”;Expression={$.CustomField1}},@{Name=”AccountLockedOutSource”;Expression={$.CustomField2}}

1 Like