Decode endpoint analytics export sentinels before calculating summaries

Source facts

Endpoint analytics exports can encode values differently from the portal. Application usage duration and mean time to failure use minutes; a mean-time-to-failure value of 2147483647 means no crash events. Several startup-time columns use seconds. In the per-device score export, -1 or -2 means the associated score is unavailable, not a measured score below zero. Microsoft Learn.

Applicability

Apply this mapping to the exact endpoint analytics report and named columns. Do not reuse a conversion merely because a different report contains a similar-looking integer.

DSE recommendation

Write a column contract before importing the export into a spreadsheet or reporting job. Preserve the raw value, its unit, and any separate status meaning. Exclude unavailable markers from numerical summaries under an explicit rule, and represent no-crash observations distinctly from a large measured duration. Have the report owner review these choices before publishing rankings or averages.

Verification

Test the transformation with records representing an ordinary measured value, an unavailable score, and the documented no-crash marker. Compare each transformed value with its portal meaning and check time-unit conversions independently. Inspect the resulting summaries for implausible extremes and unintended zero substitution. Retain the report name, export period, transformation rules, and sanitized example rows so another analyst can reproduce the result without reverse-engineering an unexplained chart.

Official references

Microsoft Learn: Troubleshooting Endpoint Analytics.