Custom SWQL Query with Search Box

So I might be thinking about this completely wrong but I have been digging around THWACK and found some really good information and want to make sure what I want to do I can actually do,

1. I setup a custom SAM template and applied it to all of my DCs to monitor for Event ID 4740 when a user gets locked out.

2. I have a domain controller dashboard that I added a custom SWQL widget to so these event would show on the page.

3. With some help from THWACK I was able to get this widget configured correctly so the events show up in the widget.

4. I have been trying to set Enable Search on this box so if a user gets locked out we can figure out where they got locked out.

5. This is what it looks like now but when I hit search and put a name in it or domain controller it looks like it is searching but it really is not.

6. Is that the purpose of the Search SWQL Query box or am I completely off base on this?

I just started using SWQL and it really looks like fun. So if there are any THWACK things I should read please pass along.

Thanks!

Find more posts tagged with

swql_search

swql_widget

Accepted answers

wluther

martian monster You almost had it. You just need to move that ${Search_String} down to the WHERE clause, and wrap it in a LIKE.

WHERE EventCode = 4740
AND ComputerName LIKE '%${Search_String}%'

You can keep adding to the WHERE, including any/all fields you want to search.

WHERE EventCode = 4740
AND ComputerName LIKE '%${Search_String}%'
OR SourceName LIKE '%${Search_String}%'
OR User LIKE '%${Search_String}%'
OR Message LIKE '%${Search_String}%'

All comments

wluther

martian monster You almost had it. You just need to move that ${Search_String} down to the WHERE clause, and wrap it in a LIKE.

WHERE EventCode = 4740
AND ComputerName LIKE '%${Search_String}%'

You can keep adding to the WHERE, including any/all fields you want to search.

WHERE EventCode = 4740
AND ComputerName LIKE '%${Search_String}%'
OR SourceName LIKE '%${Search_String}%'
OR User LIKE '%${Search_String}%'
OR Message LIKE '%${Search_String}%'

martian_monster

Thank you!!!! This will give me plenty to start working on. For the message search string will it search for a specific user in the message or will I need to do something so it will search the message?

Thank you!!

Oh and serena you didn't give me enough time to mark it as answered.

serena

https://thwack.solarwinds.com/people/martian%20monster wrote:
Thank you!!!! This will give me plenty to start working on. For the message search string will it search for a specific user in the message or will I need to do something so it will search the message?
Thank you!!
Oh and serena you didn't give me enough time to mark it as answered.

I was super excited by Will's super fast answer so I went for it Sorry!

martian_monster

This side of the office heard how happy I was to get that working!!!

wluther

martian monster That little search box is simply going to take whatever you typed in there, and dump it out everywhere it finds %{Search_String}.

So, if you are searching for "admin", it's going to fill in each of those lines like so:

WHERE EventCode = 4740

AND ComputerName LIKE '%${Search_String}%'

OR SourceName LIKE '%${Search_String}%'

OR User LIKE '%${Search_String}%'

OR Message LIKE '%${Search_String}%'

WHERE EventCode = 4740

AND ComputerName LIKE '%admin%'

OR SourceName LIKE '%admin%'

OR User LIKE '%admin%'

OR Message LIKE '%admin%'

If "admin" shows up in any of those fields, then it will return your results.

If you're looking for things/places to read up on SWQL, and the Orion SDK/API, this post has some good info to get you started, as well as a few links to additional info.

Intro to API, SDK & SWQL

For me, I found it helpful to just do a THWACK search from a part of my query, and then read just about every word on every comment that popped up.

For instance, let's say I'm looking for regular old node stuff, I would search for "From Orion.Nodes" as well as "Time", or maybe "Event", and would usually get back enough SWQL queries to make for some good investigations.

wluther

I finally got one right! Everyone needs to mark this down in the records books.

sturdyerde

Love this idea. Unfortunately search turns up nothing for me, and the 'user' column is always blank. Do either of you have user values?