Windows event log monitor - return event details in report

Question

Thanks to the community for good help in getting Windows event log monitoring figured out. 
 I can now easily create a report showing the % of polls in which the monitor did or did not find any of the requested event IDs. 
 Now requested to provide a report from Solarwinds showing Windows event details such as time generated and message. 
 Can someone advise where to find event details in SWQL Studio? I'm pretty sure the event details exist in the database because I can see the event log details under component monitor detail page. I've poked around in the APM.Component... and DynamicEvidence tables but so far can't find the information needed. 
 Thanks in advance for any help from the community.

ecmel · Accepted Answer

You can find collected Windows Event logs in " Orion . APM . WindowsEvent " object. 
 This is a basic query to pull last 100 Windows event logs: 
 SELECT TOP 100 LogFile, ToLocal(TimeGeneratedUtc) as EventTime, ComputerName, SourceName, User, Message
FROM Orion.APM.WindowsEvent
ORDER BY TimeGeneratedUtc DESC

robert777 · Answer

Thank you! This provided exactly the information needed.

Windows event log monitor - return event details in report

Top Replies