Searching Events in StackHash

StackHash makes it easy to search and filter your WinQual events. Type ‘kernel32’ in the search box and hit enter and StackHash will list all the events containing this text. If a product is selected StackHash will search events for that product, otherwise all mapped products are searched.

When text search isn't enough you can query most event, event info (hit) and cab fields. The example below will list all events with more than 100 hits:

You don't need to remember the name for each field. Click the last icon in the search toolbar to open the Search Builder window:

Each group of criteria is an AND search. In the example above we're looking for:

• Events where the module is mscorlib AND the hit count is greater than 100.
  OR
• The module is crashy AND the hit count is greater than 10 AND a Cab has been added in the last 30 days.

Note the use of ‘-30 days′. StackHash will recognize either an absolute or a relative date. The relative date is handy when running a search again from the drop down list on the search toolbar. You could use a search like ‘ehits>10 ccreated>"-7 days"’ to list events with more than 10 hits that also have had a cab added in the past week. 

In the search builder you can enter a name for a search. Named searches are included at the top of the most recent search list. 

To delete a named or recent search right click it in the drop down list and pick the Remove option.