What does Windows error code 15012 (ERROR_EVT_QUERY_RESULT_INVALID_POSITION) mean?

 
Previous Next
ERROR_EVT_QUERY_RESULT_STALE ERROR_EVT_NON_VALIDATING_MSXML

ERROR_EVT_QUERY_RESULT_INVALID_POSITION

The query cursor is positioned outside the valid result set

EvtSeek positions a query result relative to the first event, last event, current cursor or a bookmark. The offset and selected base must resolve to an event that exists in the result set. A bookmark from another channel, an offset beyond either end, or a cursor state not established by the expected API sequence can produce this error.

Verify the seek flags and whether Position is zero-based in the chosen direction. EvtSeek is supported only for Admin or Operational channel results and EVTX files, not every channel type. If the log has rolled over or been cleared, recreate the query before blaming the offset; the target record may no longer exist.

What to inspect

  • Log the seek flags, signed offset and bookmark source.
  • Confirm that the result comes from an Admin, Operational or EVTX source.
  • Recreate the query if the underlying log changed.

References


Looking for a different code? Search another status or error code.