Get-ScomAlert does not return previous 3 hours of data

Dashboard Server
1

Hi Guys!

I have a one liner script that is supposed to query certain user account locked out alerts in the last 12-hours, every time I run the command, it does not return the locked out alert for that certain user in the last 3 hours, actually the behavior is the same for any user that I query.

For example, if I run the script at 1:00:PM, it will only return data up to 10:00AM in the morning.

I think the issue is global because even for other alert, if I query using the same script, the result is the same.

What I would like to achieve is display all alerts for this user up to the current date/time, within the 12 hours period.

Below is my one liner script:

Get-SCOMAlert -Criteria ā€œResolutionState = ā€˜0ā€™ AND CustomField1 like ā€˜John.Doeā€™ ā€ | where {$.TimeAdded -gt (Get-Date).addhours(-12)} | Select @{Name=ā€Dateā€;Expression={$.TimeAdded}},@{Name=ā€Usernameā€;Expression={$.CustomField1}},@{Name=ā€AccountLockedOutSourceā€;Expression={$.CustomField2}}

Thanks!

2

I already fixed the issue after converting the TimeAdded from UTC to local time, below is the correct code:

Get-SCOMAlert -Criteria ā€œResolutionState = ā€˜0ā€™ AND CustomField1 like ā€˜John.Doeā€™ ā€ | where {$.TimeAdded -gt (Get-Date).addhours(-12)} | Select @{Name=ā€Dateā€;Expression={$.TimeAdded.ToLocalTime()}},@{Name=ā€Usernameā€;Expression={$.CustomField1}},@{Name=ā€AccountLockedOutSourceā€;Expression={$.CustomField2}}

1 Like