topic Re: Are ActivityID's for windows Events ever re-used after a period of time or reboot? in Reporting

Are ActivityID's for windows Events ever re-used after a period of time or reboot?

simoom — Thu, 18 Jul 2024 16:57:22 GMT

What I want to do is summarize a completed transaction of ActivityID's like Windows updates. However, I do not know if the ActivityID is reused again after a reboot and may not be a part of the original transaction or a period of time passes within 24 hours of my reports and the ActivityID is reused again. Disclaimer, I do not know that much about Microsoft Events... so maybe this sounds all wrong?

Re: Are ActivityID's for windows Events ever re-used after a period of time or reboot?

ITWhisperer — Thu, 18 Jul 2024 17:51:31 GMT

This is really a Windows question not a Splunk question!

Re: Are ActivityID's for windows Events ever re-used after a period of time or reboot?

simoom — Thu, 18 Jul 2024 17:53:37 GMT

My mistake Correlation[]ActivityID...

Looks like it is unique internal admin helped me out:

https://sharepoint.stackexchange.com/questions/9938/what-is-the-point-of-the-error-message-correlation-id-in-sharepoint-2010

Re: Are ActivityID's for windows Events ever re-used after a period of time or reboot?

simoom — Thu, 18 Jul 2024 17:56:36 GMT

Thank you. Though it might help someone new like me, never know.