Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

What is the SWQL needed to retrieve the events listed on main page?

I am having trouble recreating the events listing for SAM in my integration project using SAM. Please help.

So I have the following:

SELECT TOP 25 events.EventID, events.EventTime, events.NetworkNode, events.NetObjectID, events.EventType, events.Message, events.Acknowledged, events.NetObjectType, events.TimeStamp, nodes.Caption, nodes.Community, nodes.Description, nodes.Dynamicip, nodes.IpAddress, nodes.IpAddressType, nodes.LastSync, nodes.LastSystemUptimePollutc, nodes.Location, nodes.MachineType, nodes.NodeDescription, nodes.NodeName, nodes.ObjectSubtype, EventTypes.Name , EventTypes.Notify, EventTypes.Record

FROM orion.events

LEFT JOIN orion.nodes ON events.netobjectid = nodes.nodeid

LEFT JOIN Orion.EventTypes ON Events.EventType = EventTypes.EventType

ORDER BY events.EventTime DESC

Does this look correct?

Thanks in advance for any help.

Find more posts tagged with

Accepted answers

All comments

cchinn

I did some more digging and I'm pretty sure that the problem lies in the nodes.LastSync, nodes.LastSystemUptimePollutc columns in my query. These are datetime columns and in the above query some of the records the query is trying to return, these datetime values are NULL. When I revise the query to exclude these two columns, the query returns the records I know it should. Has anyone else had this problem and is there a work around?

Thanks and have a great day!

mrxinu

Are you running this in SWQL Studio or somewhere else?

cchinn

Thanks for responding to my question. Yes, I'm running this in SWQL Studio.

mrxinu

I'm not getting any errors and I'm running the same query. Having NULLs isn't necessarily a bad thing unless you're trying to do something with the column (like math/aggregates) that wouldn't work with NULL values. In which case you can just swap those values out with a CASE or ISNULL() call to make them something that's compatible with the operation.

Can you confirm the version of SWQL Studio (About menu) and show me what error you're getting?

fellowsm

I've got a similar issue, I'm running some SQL in an alert when a node comes up to count the interfaces that are admin up and contain the text ACCS which work fine, unless the node doesn't have any matching interfaces then it just shows the SQL - I'm putting the interface count into a custom field as below.

I've tried using ISNULL but still not working

this is a trigger action in the alert when the node comes up - counts admin up 'ACCS' interfaces and changes customer filed ACCScount

On ${N=Generic;M=DateTime;F=DateTime} ACCS Interface count=${SQL: SELECT ISNULL(count(*),0) as Comments FROM Interfaces where (Interfaces.AdminStatus = 1) and (Interfaces.NodeId = ${N=SwisEntity;M=NodeID} ) and (Interfaces.InterfaceAlias like '%ACCS%' ) group by Nodeid}

when the node has some matching interface it counts ok, when there are none it just puts the SQL in the custom field - any ideas

Mike