$.ajax({
    type: 'POST',
    url: '/Orion/Services/Information.asmx/QueryWithParameters',
    data: "SWQL QUERY",
    contentType: "application/json; charset=utf-8",
    dataType: "json"
})

I know this functionality is possible as table widgets can use SQL queries, I sought to find the answer within those and saw they use the path of  '/orion/rendercontrol.aspx' however while it is possible to use this to return SQL query data, it presents it as a massive long list all formatted within a HTML table itself, so all the data would then need to be extracted out of the string all contained by <td> and <tr> elements, which sounds like a logistical nightmare and is simply unnecessarily expensive computationally.

Would anyone have any pointers as to if there is a path that can be used to return SQL queries via AJAX or other methods within JavaScript? 

Writing at the end of the day, so please as questions if need be.

PS. The custom table exists within our Solarwinds Database at [SolarwindsOrion].[dbo].[customtablename]
PSS. The query we are looking to use is:

SELECT * FROM [SolarWindsOrion].[dbo].[customtablename]

Now i have requirement to make custom dashboard where this dahboard already created in last year.

When we create custom dashboard with SQL, is the SQL command will stored in the table? If yes then i can attach the old database and query to see what sql command i used to create that dashboard.

1. Make a note of Cache Status at DB Level:

CacheStatus: notCached = 0, Waiting = 1, Caching = 2, Cached = 3, Error = 4, Queued = 5

2. On DB run below Query to check the Status:

SELECT * FROM [dbo].[NCM_PolicyReports]

you can check the Status of Cache under Status Column.

If the status is other than 3 the compliance Report is not getting cached.

Change the status to 0, which will run the caching from start once services restarts.

3. Run below Query to DB

Truncate NCM_policycache
Truncate NCM_PolicyCacheResults

Restart the NCM Caching or services.

Hostname (Managed Node), IP Address, MachineType, Vendor, Site (Custom Property), Avg CPU Load (In Percentage), Peak CPU Load (In Percentage),  Avg Memory (In Percentage), Peak Memory (In Percentage), Timestamp

,Host (From the virtualization table)

,Cluster (From the virtualization table).

I tried getting the columns from hostname until timestamp through my web based report but if I want to also get the details of the Vm that is associated with hosts & cluster it requires SQL or SWQL. Can anyone help here?

One more filter to add here is, I am looking for the historical data for Last 7 days and last 30 days.

Thanks in advance.

I am creating one report for 'Interface Downtime Report' in SolarWinds Orion NPM, which consist of when it went down, when it came up, total duration of downtime, interface name and respective node name. In this, I achieved to get the desire results by creating SQL query from ChatGpt. but unable to get the desire IP Address of that respective Interface.

Below is my SQL query for the same:

INTERFACE DOWNTIME REPORT:

SELECT
E1.EventTime AS [Down_Time],
E2.EventTime AS [Up_Time],
CONVERT(varchar(8), DATEADD(SECOND, DATEDIFF(SECOND, E1.EventTime, E2.EventTime), 0), 108) AS [Downtime],
I.FullName AS [Interface_Name],
ND.SysName AS [Node_Name]
FROM Events E1
CROSS APPLY (
SELECT TOP 1 E2.EventTime
FROM Events E2
WHERE
E2.NetObjectID = E1.NetObjectID
AND E2.EventType = 11 -- Interface Up
AND E2.EventTime > E1.EventTime
ORDER BY E2.EventTime ASC
) AS E2(EventTime)
JOIN Interfaces I
ON E1.NetObjectID = I.InterfaceID
JOIN NodesData ND
ON I.NodeID = ND.NodeID
WHERE
E1.NetObjectType = 'I'
AND E1.EventType = 10 -- Interface Down
ORDER BY E1.EventTime;

Can I get the additional column to get the IP Address of that respective Interface which got reported in the above query?

Thank you in Advance!

Regards,

Tushar Tawde

Is there a way we can pull a list of devices on SolarWinds where CPU, Memory and Interfaces are not added?

Devices discovered with SNMP but resources are not added. Can we do it through a SWQL/SQL query?

To save someone else the pain - here are some examples on how to use it properly.in python.

from pprint import pprint

# disables warnings about invalid certificates if you
# have a self signed certificate
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

from orionsdk import SwisClient

server = "server"
username = "you"
password = "you_are_awesome"


swis = SwisClient(server, username, password)


sqlquery = """
    SELECT Id ,
      EntityType,
      Name,
      DisplayName , 
      DefaultThresholdOperator ,
      RecalculationNeeded, 
      ThresholdOrder, 
      Unit
    FROM SolarWindsOrion.dbo.ThresholdsNames
    where ID = 91 or Name = 'Nodes.Stats.CpuLoad'
    """


parameters = None
maxrows = 0  # no limit

results = swis.invoke("Orion.Reporting","ExecuteSQL",sqlquery, parameters, maxrows, False )
pprint(results)

Which will output:

[
{'DefaultThresholdOperator': 1,
  'DisplayName': 'CPU Load',
  'EntityType': 'Orion.Nodes',
  'Id': 82,
  'Name': 'Nodes.Stats.CpuLoad',
  'RecalculationNeeded': False,
  'ThresholdOrder': 0,
  'Unit': '%'},
 {'DefaultThresholdOperator': 1,
  'DisplayName': 'Received Interface Errors and Discards',
  'EntityType': 'Orion.NPM.Interfaces',
  'Id': 91,
  'Name': 'NPM.Interfaces.Stats.InErrorsDiscards',
  'RecalculationNeeded': False,
  'ThresholdOrder': 0,
  'Unit': '/hour'}
  ]

If you want to parameterize a SQL query, the query should have a MS SQL named parameter  like @middlename   and then you will feed it a dictionary that looks like { "middlename": "timothy" }

The same example above with properly escaped sql parameters:

from pprint import pprint

# disables warnings about invalid certificates if you
# have a self signed certificate
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

from orionsdk import SwisClient

server = "server"
username = "you"
password = "you_are_awesome"


swis = SwisClient(server, username, password)


sqlquery = """
    SELECT Id ,
      EntityType,
      Name,
      DisplayName , 
      DefaultThresholdOperator ,
      RecalculationNeeded, 
      ThresholdOrder, 
      Unit
    FROM SolarWindsOrion.dbo.ThresholdsNames
    WHERE ID = @firstid or Name = @alertname
    """


parameters = {
    "firstid": 91,
    "alertname": "Nodes.Stats.CpuLoad"
}
maxrows = 0  # no limit

results = swis.invoke("Orion.Reporting","ExecuteSQL",sqlquery, parameters, maxrows, False )
pprint(results)

SELECT
T.[Node name]
,T.[Start of Downtime]
,T.[End of Downtime]
,T.[Duration]
FROM (

SELECT
N.Caption AS [Node Name],
E.EventTime AS [Start of Downtime],
(SELECT TOP 1
EventTime
FROM Orion.Events AS EndEvent
WHERE
EndEvent.NetworkNode = E.NetworkNode
AND EndEvent.EventTime > E.EventTime
AND EndEvent.EventType = 5) AS [End of Downtime]
,MINUTEDIFF(E.EventTime,
(SELECT TOP 1
EventTime
FROM Orion.Events AS EndEvent
WHERE
EndEvent.NetworkNode = E.NetworkNode
AND EndEvent.EventTime > E.EventTime
AND EndEvent.EventType = 5)
) AS [Duration]
FROM Orion.Events AS E
INNER JOIN Orion.Nodes AS N ON E.NetworkNode = N.NodeID
WHERE
E.EventType = 1
AND E.EventTime>ADDDAY(-7,GETDATE())
AND N.Caption LIKE '%imbox%'
ORDER BY
E.EventTime DESC
) AS T
WHERE
T.[Duration]>60

When deploying SolarWinds HCO for an enterprise client we stumbled upon sporadic slowness of the web GUI with no obvious pattern.
After heaps of troubleshooting with a DBA and network expert, adding more pollers, additional web servers behind a load balancer, leaving only the bare minimum on the MPE,
the only solution that had a consistent results is setting the packet size in the application connection string to a large number (32,768).

Now we are trying to figure out why that works as we feel like this is a band-aid solution that does not address the source of the problem.

All guesses and speculations are welcomed, I'd love to hear your thoughts!

We just migrated our SQL back end and was just made aware that SQL filestream is still enabled for the database.  I tried doing some searching on this issue and kept finding dead links.  This came up because our backup product was complaining about SQL filestream.  I tried looking for any documentation on this put keep coming up with dead links. 

Does anyone have any ideas?

I would like to add the option to select either custom SWQL or custom SQL.  This will allow more flexibility on the modern dashboards.

If it is not possible to add it to the existing widgets, then add separate widgets that use custom SQL.

SELECT TOP 1000 EntityUri, Caption, IPAddress, tostring(SuppressFrom) as [Suppression From],
case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then 'Not set'
else tostring(SuppressUntil ) end AS [Suppression To]

,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then 'Unlimited Time Period'
else tostring(daydiff(getutcdate(), asu.SuppressUntil)) end as [Days Left],
NCP.MWTaskNumber

FROM Orion.AlertSuppression asu
join orion.nodes N on asu.entityuri=N.uri
LEFT JOIN Orion.NodesCustomProperties NCP on N.NodeID = NCP.NodeID

I've tried to add the Custom Properties to the mix and the code comes back as success, but the field doesn't show after the Test, this is the code within ServiceNow;

(function execute(inputs, outputs) {
  var limit = inputs.Limit;
  
  var npmInstalled = new sn_solarwinds_inte.SolarWindsUtil().getNpmInstalled(inputs.connectionAlias);
  var samInstalled = new sn_solarwinds_inte.SolarWindsUtil().getSamInstalled(inputs.connectionAlias);
  var comment = "--hardware sam:" + samInstalled + " npm:" + npmInstalled + "\r\n";
  
  var emptyFieldQuery = "'' AS ";
  
  var connectionSelect = "'" + inputs.connectionAlias.sys_id + "' AS ConnectionId, ";
  
  var nodesSelect = "Nodes.InstanceSiteId, Nodes.NodeID, Nodes.IPAddress, Nodes.IPAddressType, Nodes.DynamicIP, Nodes.Caption, Nodes.Category, Nodes.NodeDescription, Nodes.Description, Nodes.DNS, Nodes.SysName, Nodes.Vendor, Nodes.IOSImage, Nodes.IOSVersion, Nodes.CPUCount, Nodes.MachineType, Nodes.IsServer, Nodes.TotalMemory, Nodes.CMTS, Nodes.IP, Nodes.IP_Address, Nodes.LastSync";
  
  var nodesCustomPropertiesSelect = "nodesCustomProperties.Environment";
  
  var hardwareHealthSelect = ((samInstalled == "true" || npmInstalled == "true") ? "HardwareHealth.Manufacturer, HardwareHealth.Model, HardwareHealth.ServiceTag" : (emptyFieldQuery + "Manufacturer, " + emptyFieldQuery + "Model, " + emptyFieldQuery + "ServiceTag"));
  
  var serverInformationSelect = (samInstalled == "true" ? "ServerInformation.HostName" : (emptyFieldQuery + "HostName")) + ", " + (samInstalled == "true" ? "ServerInformation.SystemName" : (emptyFieldQuery + "SystemName")) + ", " + (samInstalled == "true" ? "ServerInformation.Domain" : (emptyFieldQuery + "Domain")) + ", " + (samInstalled == "true" ? "ServerInformation.DNSName" : (emptyFieldQuery + "DNSName")) + ", " + (samInstalled == "true" ? "ServerInformation.DomainRole" : (emptyFieldQuery + "DomainRole")) + ", " + (samInstalled == "true" ? "ServerInformation.AssetType" : (emptyFieldQuery + "AssetType")) + ", " + (samInstalled == "true" ? "ServerInformation.OperatingSystem" : (emptyFieldQuery + "OperatingSystem")) + ", " + (samInstalled == "true" ? "ServerInformation.OSVersion" : (emptyFieldQuery + "OSVersion")) + ", " + (samInstalled == "true" ? "ServerInformation.OSArchitecture" : (emptyFieldQuery + "OSArchitecture")) + ", " + (samInstalled == "true" ? "ServerInformation.ServicePack" : (emptyFieldQuery + "ServicePack")) + ", " + (samInstalled == "true" ? "ServerInformation.OSLanguage" : (emptyFieldQuery + "OSLanguage")) + ", " + (samInstalled == "true" ? "ServerInformation.HardwareSerialNumber" : (emptyFieldQuery + "HardwareSerialNumber")) + ", " + (samInstalled == "true" ? "ServerInformation.ProductNumber" : (emptyFieldQuery + "ProductNumber")) + ", " + (samInstalled == "true" ? "ServerInformation.Manufacturer AS ServerInformationManufacturer" : (emptyFieldQuery + "ServerInformationManufacturer")) + ", " + (samInstalled == "true" ? "ServerInformation.Model AS ServerInformationModel" : (emptyFieldQuery + "ServerInformationModel")) + ", " + (samInstalled == "true" ? "ServerInformation.LastLoggedInUser" : (emptyFieldQuery + "LastLoggedInUser")) + ", " + (samInstalled == "true" ? "ServerInformation.Contact" : (emptyFieldQuery + "Contact")) + ", " + (samInstalled == "true" ? "ServerInformation.ProcessorCount" : (emptyFieldQuery + "ProcessorCount")) + ", " + (samInstalled == "true" ? "ServerInformation.TotalMemoryB" : (emptyFieldQuery + "TotalMemoryB")) + ", " + (samInstalled == "true" ? "ServerInformation.VirtualMemoryB" : (emptyFieldQuery + "VirtualMemoryB")) + ", " + (samInstalled == "true" ? "ServerInformation.PartOfDomain" : (emptyFieldQuery + "PartOfDomain")) + ", " + (samInstalled == "true" ? "ServerInformation.DeviceType" : (emptyFieldQuery + "DeviceType"));
  
  outputs.body = JSON.stringify({"query": comment + "SELECT " + connectionSelect + nodesSelect + ", " + nodesCustomPropertiesSelect + ", " + hardwareHealthSelect + ", " + serverInformationSelect + " FROM Orion.Nodes AS Nodes " + ((samInstalled == "true" || npmInstalled == "true") ? "LEFT OUTER JOIN Orion.HardwareHealth.HardwareInfo AS HardwareHealth ON Nodes.InstanceSiteId = HardwareHealth.InstanceSiteId AND Nodes.NodeId = HardwareHealth.NodeId " : "")  + ((samInstalled == "true" || npmInstalled == "true") ? " LEFT OUTER JOIN Orion.NodesCustomProperties AS nodesCustomProperties ON Nodes.NodeId = nodescustomProperties.NodeId" : "") +  (samInstalled == "true" ? "LEFT OUTER JOIN Orion.AssetInventory.ServerInformation AS ServerInformation ON Nodes.NodeId = ServerInformation.NodeId AND Nodes.InstanceSiteId = ServerInformation.InstanceSiteId" : "") + " ORDER BY InstanceSiteId, NodeID WITH ROWS " + inputs.Offset  + " TO " + limit});
  
})(inputs, outputs);

Any help would be greatly appreciated, I've been going round and round trying to figure this out for over 3 weeks now 

Appologies if this is the wrong place to ask, however I'm looking for a bit of advice/help with the above topic.

Essentially, we have four pollers which we're trying to balance out. What we have found that is one of our pollers has a significantly higher component count, even though the node count against the four pollers are fairly evenly balanced!

I did reach out to support to see if they could provide me with a SWQL query to get the number of components each node within SAM has, but they advised that they couldnt and deferred me to Thwack.

Does anyone have a query or able to help me build a query in order to achieve this.

Cheers!

I am looking to generate a report pulling from information gathered from the PerfStack Analysis. It's from an out-of-the-box widget that lists the following information:

Specifically, I'm looking to make a report based on the availability of the last 30 days, but I don't know where to even find the stored information to query it. Where might that availability column be stored? 

Any tips, tricks, or information would be appreciated. 

I have a SWQL query to get my VMware datastore serial numbers, vcenter servers, cluster and the vendor, i ideally need to strip out everything in the vendor column after the first '(' but cant get it to work, im fairly new to SQL/SWQL, so any advise would be amazing, SWQL query is below:

SELECT d.Clusters.DataCenter.VCenter.DisplayName as vCenterName, d.clusters.DisplayName as ClusterName,d.name as Volume, l.LunID, SUBSTRING(l.CanonicalName,13,24) as SerialNumber,
l.Name as Vendor
FROM Orion.VIM.Datastores d
LEFT JOIN Orion.VIM.Luns l ON d.DataStoreID = l.DataStoreID
where (l.CanonicalName is not NULL
or l.CanonicalName != ''
)
and l.name not like '%local%'
and l.name not like '%HP Serial Attached SCSI Disk%'

(2) NCM_Audit queries battering the SolarWinds DB - Forum - Network Configuration Manager (NCM) - THWACK

Background:

User experience error while browsing the web

Troubleshooting:

there is log on event viewer as well for netflow service (NTA)

check DB log showing same error is for all polling engines (main and additional)

I browsed the web that this might be due to SPN issue 

2025-05-19 22:19:10.430 Server SQL Server is attempting to register a Service Principal Name (SPN) for the SQL Server service. Kerberos authentication will not be possible until a SPN is registered for the SQL Server service. This is an informational message. No user action is required.
2025-05-19 22:19:10.440 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/CBTCNBSLWDB01 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2025-05-19 22:19:10.440 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/CBTCNBSLWDB01:1433 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.

Issue:

To resolve SPN issue need to register the SPN either manually or automatically using setspn command, but since our servers is not joined to AD the setspn command is not working
Any ideas on how to get around this issue? or is there any other workaround?

Does anyone know the SQL/SWQL code or the required table to get the NTA top 50 Endpoints? I need to do some customization on the report.

Thanks,

Dinith

I have SWQL code that creates a table from two UnDP with an output of a percentage. The RawStatusRatio and the the SecondAssignment is what I need in an email for alerting purposes. The original SWQL for both the table and the Alert Condition itself seems to not have an issue but I cannot get the table to display in the email action. At worst I would be willing to get the two requirements (RawStatusRatio and the the SecondAssignment) but I'm trying to get the information from the code itself.

Eventually I would like to use the ${NodeID} variable so I can associate with multiple devices but that is for another day.

SELECT
    a.NodeID,
    a.AssignmentName AS FirstAssignment,
    a.RawStatus AS FirstRawStatus,
    b.AssignmentName AS SecondAssignment,
    b.RawStatus AS SecondRawStatus,
    (a.RawStatus * 1.0 / b.RawStatus) AS Percentage
FROM Orion.NPM.CustomPollerStatusOnNode a
JOIN Orion.NPM.CustomPollerStatusOnNode b
    ON a.NodeID = b.NodeID
    AND a.AssignmentName < b.AssignmentName  -- Ensures distinct assignments for comparison
WHERE a.NodeID = '18656'
AND a.AssignmentName LIKE 'fw%'
AND b.AssignmentName LIKE 'fw%'
ORDER BY a.AssignmentName, b.AssignmentName;

In turn, I have created an SWQL alert where the Trigger Condition works. I can show that it triggers when the condition is below 6% but does not above 6%. I get the email and log message.

The issue that I have is that I believe I should be able to add the SWQL/SQL code in the email message, delayed by 5 minutes, but it keeps returning the code itself. I've had no issue using variables in other alerts but this one is stumping me. Changing it from SQL to SWQL seems to have the same issue.

${N=SQL;M=SELECT 
    a.NodeID,
    a.AssignmentName AS FirstAssignment,
    a.RawStatus AS FirstRawStatus,
    b.AssignmentName AS SecondAssignment,
    b.RawStatus AS SecondRawStatus,
    (a.RawStatus * 1.0 / b.RawStatus) AS RawStatusRatio
FROM Orion.NPM.CustomPollerStatusOnNode a
JOIN Orion.NPM.CustomPollerStatusOnNode b 
    ON a.NodeID = b.NodeID 
    AND a.AssignmentName < b.AssignmentName  -- Ensures distinct assignments for comparison
WHERE a.NodeID = '18656' 
AND a.AssignmentName LIKE 'fw%' 
AND b.AssignmentName LIKE 'fw%'
ORDER BY a.AssignmentName, b.AssignmentName;}

Any help would be greatly appreciated. I will also upload the alert and documentation once I get this last part working.

Thank you,

I recently upgraded to the latest version of SolarWinds, which enabled Memory-Optimized tables by default. Upon reaching out to support, I was advised that a resource pool must be assigned. However, when I requested specifics on calculating the minimum and maximum values for the pool based on table usage, there was no clear guidance provided. This issue has now been ongoing for over a month without resolution.

Has anyone encountered a similar scenario? If so, how did you determine the appropriate resource pool configuration?

Any insights or suggestions would be greatly appreciated.

We see under Datbase Details that it list what web server we are on so its drawing it from somewhere, but I cannot connect the dots.

Does anyone know a query to use or what SW is using to display this info?

Off the back of this Custom Property information, such as Environment and DeviceRole I'd like to specify a set range of thresholds

Example

The above DeviceRole is Database and Environment Live (Prod) and Dev, so I'd like to set these Warning and Critical figures. the criteria is the length of time before the alert triggers.

I have this SQL code so far (extracted from previous post on here so thanks for that .... link) 

update dbo.Thresholds
set ThresholdType = 1, Warning = 90, Critical = 95
where ThresholdNameId =1 AND N.CustomProperties.Environment = Production AND N.CustomProperties.DeviceRole = Database

I've managed to pull this off AI but not had a chance to access my lab to test it yet;

UPDATE dbo.Threshold
SET 
    WarningThreshold = 92,
    CriticalThreshold = 95
WHERE 
    NodeID IN (
        SELECT NodeID 
        FROM Orion.NodesCustomProperties 
        WHERE Environment = 'Live' 
        AND DeviceRole = 'Database'
    );

Anyone already doing something similar to this, really appreciate any input.

Thanks

Here is the SQL statement being used:

SELECT  Name,  Status, ISNull(NN.Note, '') AS  NodeNotes, DetailsUrl,  Application.Node.DisplayName,  ToLocal(AStat.LastSuccessfulPoll) AS LastGoodPoll,  Application.Node.NodeID,   Application.Node.DetailsUrl  AS  NodeDetailsUrl,  Application.Node.Status  AS  NodeStatus,  Application.Node.ChildStatus 
FROM  Orion.APM.Application  
LEFT JOIN  Orion.NodeNotes   NN  ON  NN.NodeID  =  Application.Node.NodeID  
LEFT JOIN  Orion.APM.CurrentApplicationStatus   AStat  ON  AStat.ApplicationID  =  Application.ApplicationID 
WHERE  Status  <>  1

Thanks.