For a long time now, we have had to take long detours to combine row values into single cell values. We had to turn to SQL based XMLPATH, and later on STRING_AGG to aggregate data – but now with OSH 2026.4.0, we have STRING_AGG in SWQL as well!!
(While reading this, remember the distinction between SQL and SWQL)
Why does this matter?
In several scenarios, you want values from several rows to appear in just one string value, one cell. In variables in alert actions, for example, only one string variables are accepted. In custom tables or reports, you might want to combine several values.
Suppose you have a table with users:
You can in SQL run:
SELECT
STRING_AGG(Name, ', ') AS AllNames
FROM Employees;
To get the result:
Now, as of SWOSH 2026.4.0, you can do that in SWQL as well!
How to use it
STRING_AGG(expression, separator [, orderExpression [ASC | DESC])
- Expression – the expression or column that holds the data (Required)
- Separator – How to separate the data (Required), examples:
- Sort by – How to sort the expression data, direction can also be chosen where ASC is default (Optional)
See also:
https://solarwinds.github.io/OrionSDK/docs/swql-functions/
Examples
Return groups with their members:
Return nodes with all their IP addresses:
Combine STRING_AGG with Group BY:
Combine CONCAT and STRING_AGG:
Notes
Returns NULL when expression contains no non-NULL values
SWQL use of STRING_AGG() requires your SWOSH database to be on at least MS SQL 2017
