Automating the export of EVENTS?

stuartd

First, is there a way to take the content of the events log, including all alerts, warnings, informational, etc and then export that to a text file?

Second, is there a way to automate this on a scheduled basis?

I'm guessing a combination of SWQL and PowerShell but whilst I have found the Orion.AlertHistory table, it doesn't appear to contain all of the information one sees in events on the GUI. And let's not even mention the PowerShell at this stage as I have no clue

stuartd

Talking to myself, again, I've sussed out the SWQL side of it (at least I think so)... but this only works for a specified date. I don't know enough S(W)QL to say grab today, or yesterday,  or grab the last hour or etc...

Anyway, the query is:

SELECT 
         Events.NetObjectType, 
         Events.NetObjectID, 
         Events.NetObjectValue, 
         Events.EventID, 
         Events.Acknowledged, 
         Events.EventTime,
         Events.EventType, 
         Events.Message, 
         ISNULL(EventTypes.BackColor, 0) as BackColor,

         OrionSite.Name as OrionSiteName, 
         OrionSite.SiteID as OrionSiteID
FROM Orion.Events as Events
LEFT JOIN Orion.EventTypes as EventTypes ON Events.EventType = EventTypes.EventType AND Events.InstanceSiteID = EventTypes.InstanceSiteID
LEFT JOIN Orion.Nodes as NodesData ON Events.NetworkNode = NodesData.NodeID AND Events.InstanceSiteID = NodesData.InstanceSiteID
LEFT JOIN Orion.Sites As OrionSite ON OrionSite.SiteID = Events.InstanceSiteID
AND  Events.EventTime >= '2021-11-19'
ORDER BY Events.EventTime DESC

Then I can automate using a windows scheduled task to run my query wrapped up into a PowerShell query. That's the other aspect I could do with an assist on please?