SWQL query to get description of alerts, active and inactive for a node within the past 30 days?

williammy

I'm trying to put together a swql query that I can feed either a Node ID or Caption/name and pull up a history of the alerts on it in the past 30 days , so that we can troubleshoot further.

Here's what I have so far but it just displays the state and duration, I'm trying to figure out how to correlate what was being flagged/alerted.

SELECT 
    n.Caption, 
    n.IPAddress, 
    n.CustomProperties.DeviceType,
    n.NodeDowntimeHistory.Description,
    n.NodeDowntimeHistory.DisplayName,
    n.NodeDowntimeHistory.TotalDurationMin,
    n.NodeDowntimeHistory.State
FROM Orion.Nodes n
WHERE 
    n.Caption = 'MYSERVER'
    AND n.NodeDowntimeHistory.DateTimeUntilNow >= ADDDAY(-30, GETUTCDATE())