Version 1

    There are some other articles on filtered events (


    However, I did this one last week and liked the look and feel of it.  The only issue is that NetPath does not show up cleanly, as the string functions are a bit limited in SWQL.  I could use SQL, but then I don't get the nice pages that I want.


    I found it useful for showing filtered events based on custom properties and other metric (like just hardware events).


    SELECT top 100

    concat(SUBSTRING(tostring(tolocal(e.EventTime)),1,4),SUBSTRING(tostring(tolocal(e.EventTime)),5,2),SUBSTRING(tostring(tolocal(e.EVENTTIME)),12,8)) as [Time]

    , e.message as [Message]

    ,'/NetPerfMon/Images/Event-'+tostring(e.EventType)+'.gif' as [_IconFor_Message]

    ,'/Orion/View.aspx?NetObject='+e.NetObjectType+':'+tostring(e.NetObjectID) as [_LinkFor_Message]

    FROM Orion.Events e

    where DAYDIFF(tolocal(e.EventTime),GETDATE()) = 0

       and e.message like '%${SEARCH_STRING}%'

    order by 1 ASC