Node alert convert from SQL to SWQL

Nollipop

Hi!

Need some help with translating some of this SQL to SWQL.
First of all this is the script that im trying to convert:
join cpumultiload on nodes.nodeid = cpumultiload.nodeid
where datediff(mi, cpumultiload.timestamputc, sysutcdatetime()) <5
and cpumultiload.avgload >90
and (Nodes.caption like '%map%')

this is the SWQL i've done so far:

join orion.cpumultiload on nodes.nodeid = cpumultiload.nodeid
where ---------------
and ( cpumultiload.[avgload] > '90' )
and ( nodes.[customproperties].[cpu_alert] = 'true' )

so the case here is that i need help to convert the "where datediff(mi, cpumultiload.timestamputc, sysutcdatetime()) <5" to SWQL.

mikesky

This is the cheat sheet for SWQL functions.

So what you need to use is MinuteDiff(a,b) and GetUtcDate().  Here's another tip: CPUMultiload is already linked to Nodes as: Orion.Nodes.CPUMultiLoadHistory (I have no idea why it's not linked under the same name).  It eliminates the need for the JOIN.  This is similar to how you're dot-walking to the CustomProperties table already.  I think your resulting code would be:

WHERE MinuteDiff(NODES.CPUMULTILOADHISTORY.TimeStampUTC,GetUtcDate()) < 5
AND ( NODES.CPUMULTILOADHISTORY.AvgLoad > '90' )
AND ( NODES.CUSTOMPROPERTIES.CPU_Alert = 'true' )