Exporting list from application monitor component

mbird

I have an application monitor component logging event 540 for successful logons... is there any way I can export this data to a spreadsheet so I can filter and sort it?

Right now I can't even select the data to copy and paste it, it would be helpful if I could sort this and for instance remove all the times the user account for SolarWinds gets logged in there because that's not the data I'm after.

Anyone have any suggestions, or is there a different way I can do this? What I really would like would be a list of these users who are accessing a specific executable, but I think that puts us over in LEM-land... which we don't have a license for.

mesverrum

Try this query in a report or custom query resource

SELECT ComputerName, we.component.application.Name as [Application], SourceName, tostring(tolocal(TimeGeneratedUtc)) as [Timestamp], Message

FROM Orion.APM.WindowsEvent we

WHERE computername like '%'

and we.component.application.Name like '%'

and Message like '%'

As it sits that would report on all of the events across all monitors, but you should be able to figure out how to filter it down with the where conditions i put in there