How to create a "Node Added" Report for the past 12 months?

The default retention for events is 30 days so it appears that using events is out of the question. I noticed that under the Message Center I can filter audits to show Node Added. "User XX created node XXX" Yet when I am trying to search for these events in the database under Orion.AuditingEvents I cannot find any even extremely recent ones. What am I missing here?

Is a report like this possible? I feel like I can easily come up with the query just need pointed in the right direction. Any help would be appreciated.

Find more posts tagged with

swql query

SWQL

Events

node added

report

Accepted answers

bobmarley

SELECT TOP 9000 AuditEventID, TimeLoggedUtc, AccountID, ActionTypeID, AuditEventMessage, NetworkNode, NetObjectID, NetObjectType, DetailsUrl, DisplayName, ObservationTimestamp, ObservationRowVersion, ObservationSeverity, ObservationSeverityName, Description, InstanceType, Uri, InstanceSiteId
FROM Orion.AuditingEvents

Where AuditEventMessage LIKE '%created node%'

Order BY TimeLoggedUTC desc

All comments

bobmarley

Where AuditEventMessage LIKE '%created node%'

Order BY TimeLoggedUTC desc

Wildhammer

Fantastic! Thank you for this!