For Powershell monitor, where is "Multiple Statistics Data" historical data in SWQL?


My question is related to the following question from the forum that is now closed, hence this new question. Here is the link to the original:

I have a brand new SAM install I built last week, so everything is latest and greatest (2023.2).

One of the solutions in that link provided by @mesverrum and working for @cmarti is (with slight edits by myself):

    tolocal(Timestamp) as Timestamp,
     cs.Component.Application.Node.dns as Hostname,
     cs.Component.Application.Name as ApplicationName,
     cs.Component.Name as component,
     cs.DynamicEvidence.ColumnLabel as Label,
     cs.DynamicEvidence.StringData as StringData,
FROM Orion.APM.ComponentStatus cs
order by timestamp desc

There is over 15,000 records that covers 5 days. AvgNumericData contains values that make sense. That all makes sense. My issue is StringData is always NULL which is not the expected result.

Am I missing something here? Is my expectation that StringData should contain something other than NULL not correct?
If you have any applications with Windows Powershell Monitor components running, can you run the above query in SWQL Studio and report the contents of StringData?

TIA :-)

  • Hi,

    For the latest data, you can use "Orion.APM.MultipleStatisticData" to pull the string value with StringData column.

    For historical data, I guess there is a problem in the latest release. I can see string data in "Orion.APM.DynamicEvidence" table for the rows having ColumnType value set to "0" in an installation running Orion version 2020.2.6. Unfortunately I can't see any row having ColumnType value set to "0" in another environment which is running on 2023.2.1.

    In addition to this, I see this note in SWQL Studio for "Orion.APM.DynamicEvidence" object:  Orion.APM.DynamicEvidence will be removed in a future version of the product. Please use Orion.APM.DynamicEvidenceChart

    I also checked Orion.APM.DynamicEvidenceChart but it does not have a StringData column.

    In my opinion, there is a bug in the new release but I would suggest raising a ticket to SolarWinds to verify it and ask for a fix.

  • Thanks for the reply!!! This is very helpful. I already have a ticket in but all support has done is verify they are seeing the same result as I am.

    BTW if you go looking in the database directly you'll see the same issue with 2023.2, so I don't think this is an issue with SWQL as it is pulling what is in the database. I think the issue is that the stringdata column is not correctly populated in 2023.2.

    Where exactly did you find "Orion.APM.DynamicEvidence will be removed in a future version of the product. Please use Orion.APM.DynamicEvidenceChart"? I can't find that in the github repo and my google-fu isn't finding anything like that. Can you provide a link if one is available? 

    Yeah I also looked at Orion.APM.DynamicEvidenceChart and came to the same conclusion...

  • I saw that message in SWQL Studio:

    If you haven't used SWQL Studio before, I would strongly recommend it as you can easily create and test your queries or other API actions. It is coming as part of Orion SDK. I'm sharing several links below:

Reply Children
  • I have been using SWQL Studio but apparently not looking hard enough :-P I see it now.

    This explains why Orion.APM.DynamicEvidence is displayed with strikethru in the tree...and if you uncheck Preferences > Show Obsolete then it doesn't show up in the tree at all. Since I could not find the string "DynamicEvidence" in the source code the documentation must be coming from the database itself. 

    So Orion.APM.DynamicEvidence is obsolete and going away...frustrating...maybe the lack of updating the stringdata is thte first step...