Ok, I’m just going to say it: I love merge-splogfile. If you have any SharePoint 2010 farms with more than a few servers, you probably know what I’m talking about. My relationship with merge-splogfile hasn’t always been butterflies & unicorns though; we got off to a rocky start to say the least. I can’t even tell you how many times I’ve tried running it with the correlation switch only to return: WARNING: Cmdlet did not return any records in the log file. Check your time range or filters.
Not cool, man! So I’d check the ULS logs & see this: The Execute method of job definition Microsoft.SharePoint.Diagnostics.SPMergeLogFilesJobDefinition threw an exception. More information is included below. Guid should contain 32 digits with 4 dashes (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).
Huh?! I knew the correlation ID existed & I knew the GUID was in the right format. So what gives? I scratched my head for a while & eventually punted a case over to our talented escalation engineers. Long story short, they ultimately determined that if you have a site or library or anything with the word “transfer” in the name, and have any activity for that URL in your ULS logs, bam – there’s your problem. Wow – really?! Yup, really…
But here’s the good news: Feb 2013 CU! Check out bullet #2 under the “issues that this hotfix package fixes” section. J
So if this sounds familiar and you're also starting to lose faith in merge-splogfile, check your ULS logs & look for the word transfer. If you see it, Feb CU baby!
until next time - keep on mergin'!