"Nodes Currently Muted" report broke after 2025.4.0 upgrade

KNW316

We have a SWQL report that shows all nodes currently muted, which user account muted it, and what time the mute window starts/ends. This was very useful in holding the user accountable for unmuting their own nodes or establishing an end time.

Ever since upgrading to SW Platform 2025.4, our report shows the account who muted the server as "system" no matter who muted it. I tried to use Copilot a bunch of different ways to update the report based on the conditions below, but it kept returning "query is not valid." I'm at a loss. Can anyone help?

SolarWinds support said:

The user who initiated the action (admin) is still logged -but not under “Alerts muted” (ActionTypeDisplayName LIKE ‘%mute%’) anymore.Instead:

• User actions now appear under:
  • ActionTypeID 314 (Schedule added)
  • ActionTypeID 317 (Schedule assignment added)
• System-level execution appears under:
  • ActionTypeID 66 (Alerts muted)
  • ActionTypeID 322 (Schedule executed)

This means your custom condition: 

WHERE [AT].ActionTypeDisplayName LIKE '%mute%'

no longer aligns with how mute events are recorded in 2025.4, which is why your report always returns “system”.
ActionTypeID values are not universal. They may vary between environments, so you should verify the correct mappings in: 

SELECT ActionTypeID, ActionTypeDisplayName

FROM Orion.AuditingActionTypes

What This Means for Your Custom SWQL Query In Your Report

Your custom SWQL query will likely need adjustments to adapt to the new behavior, especially around filtering and correlating entries from ActionTypeDisplayName or ActionTypeID.

KNW316

SELECT Status,EntityUri, UtcSuppressFrom, UtcSuppressUntil, LocalSuppressFrom, LocalSuppressUntil, Element, DetailsUrl, AE2.AccountID,Comments

FROM

(

SELECT DISTINCT [EntityUri],

[SuppressFrom] AS [UtcSuppressFrom],

[SuppressUntil] AS [UtcSuppressUntil],

ToLocal([SuppressFrom]) AS [LocalSuppressFrom],

ToLocal([SuppressUntil]) AS [LocalSuppressUntil],

CASE

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'

THEN [N].[Caption]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'

THEN [I].[FullName]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'

THEN [AA].[FullyQualifiedName]

ELSE 'SomethingElse'

END AS [Element],

CASE

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'

THEN [N].[DetailsUrl]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'

THEN [I].[DetailsUrl]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'

THEN [AA].[DetailsUrl]

ELSE '<a href="/Orion/SummaryView.aspx">SomethingElse</a>'

END AS [DetailsUrl],

CASE

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'

THEN [N].[Status]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'

THEN [I].[Status]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'

THEN [AA].[Status]

ELSE 30

END AS [Status],

[CP].Comments,

[AE].AccountID

FROM Orion.AlertSuppression AS [AlertSup]

LEFT OUTER JOIN Orion.Nodes AS [N]

ON [AlertSup].[EntityUri] = [N].[Uri]

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I]

ON [AlertSup].[EntityUri] = [I].[Uri]

LEFT OUTER JOIN Orion.APM.Application AS [AA]

ON [AlertSup].[EntityUri] = [AA].[Uri]

LEFT OUTER JOIN Orion.NodesCustomProperties AS [CP]

ON [N].[NodeID] = [CP].[NodeID]

LEFT OUTER JOIN Orion.AuditingEvents AS [AE]

ON [AE].AuditEventMessage LIKE CONCAT('%', CASE

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'

THEN [N].[NodeName]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'

THEN [I].[InterfaceCaption]

WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'

THEN [AA].[Name]

ELSE 'Wrong'

END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID)

INNER JOIN Orion.AuditingActionTypes AS [AT]

ON [AE].ActionTypeID = [AT].ActionTypeID

WHERE [AT].ActionTypeDisplayName LIKE '%mute%'

) AS tbl1

JOIN

(

SELECT NetObjectID, MAX(TimeLoggedUtc) AS MaxTimeLoggedUtc

FROM Orion.AuditingEvents AS AE

INNER JOIN Orion.AuditingActionTypes AS [AT]

ON [AE].ActionTypeID = [AT].ActionTypeID

WHERE [AT].ActionTypeDisplayName LIKE '%mute%'

GROUP BY NetObjectID

) AS tbl2 ON tbl1.EntityUri LIKE CONCAT('%=', tbl2.NetObjectID)

JOIN Orion.AuditingEvents AS AE2 ON tbl2.NetObjectID = AE2.NetObjectID AND tbl2.MaxTimeLoggedUtc = AE2.TimeLoggedUtc