Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Issue on getting the last 7 days records from AlertHistory table

Hi,

I can run the below queries (1 and 2) to get some alert records from Orion.AlertHistory table without any issue.

Query 1: To get all alerts for alertObject 589 and 590, with some parsed values.

SELECT TimeStamp As EventTime,Message,
ARRAYVALUEAT(SPLITSTRINGTOARRAY(REPLACE(Message,' ','|§|§|')),8) AS User,
ARRAYVALUEAT(SPLITSTRINGTOARRAY(REPLACE(Message,' ','|§|§|')),10) AS ConnectionIP,
ARRAYVALUEAT(SPLITSTRINGTOARRAY(REPLACE(Message,' ','|§|§|')),12) AS Event,
ARRAYVALUEAT(SPLITSTRINGTOARRAY(REPLACE(Message,' ','|§|§|')),17) AS AssignedIP
FROM Orion.AlertHistory where AlertObjectID = 590 OR AlertObjectID = 589 ORDER BY EventTime ASC

Query 2: Get the same records in the last 7 days without the parsed values.

SELECT TimeStamp As EventTime,Message
FROM Orion.AlertHistory where AlertObjectID = 590 OR AlertObjectID = 589 and EventTime >= AddDay( -7, GETDATE()) ORDER BY EventTime ASC

Query 3: Trying to get the last 7 days records with the parsed values, here am getting 'Invalid parameter 1 specified for dateadd', which is working fine in Query 2.

Could you please help me to get this work?

Thanks in advance.

Find more posts tagged with

swql query

Reports

SWQL

SWQL Studio

Accepted answers

Seashore

I can't run it at all on my labb. Think it's because my messages are note formated in the way yours are.
BUT, I get the same error when you run Query 3, think I have seen that before.

First I think you want a () around your alertobjects in the where clause. Second, I changed from using the AddDay to just do a "getdate()-7"

End result looks like this:

FROM Orion.AlertHistory

WHERE

(AlertObjectID = 590 OR AlertObjectID = 589)

AND EventTime >= GETDATE()-7

Can that work?

All comments