SWQL Query not pulling matching NodeID

Confirming your use case.  If you use case is the to have a single standard trigger for all alerts to make service-now alerts I have not come up with a good way to do that with the out of the box service-now integration (I had to write a custom script to do this).  

What is the focus of your alert (I want to alert on:) on the trigger condition?  This will effect the root object/table for ${N=SwisEntity;. Interfaces can link up to nodes, but not all properties will be available when you link down from Nodes to interfaces.

As a personal preference, I like to pull NodeName vs caption.  Easier to see at a glance, and if bulk auditing alerts or log files you can easily tell node vs interface/volume (which usually have caption).

So at the moment i have two alerts one a Node alert type for 'Node = Down' and the other an Interface alert type for 'Interface = Down'

The Raise ServiceNow ticket actions are identical except the 'Configuration Item' where i want to populate the Node name for both alerts but

For 'Node = Down' i have to use the variable '${N=SwisEntity;M=Caption}'

AND

For 'Interface = Down' i have to use the variable '${N=SwisEntity;M=Node.Caption}'

I was hoping the variable script below would work for both cases to pull the Node Caption. I could then have only the one Raise ServiceNow action assigned to both alerts.

${N=SWQL;M=SELECT Caption from Orion.Nodes WHERE ${N=SwisEntity;M=Node.NodeID} = ${N=SwisEntity;M=NodeID} } 

But as described in my initial the script is incorrectly matching the NodeIDs across the Node and Interface tables and so is pulling the incorrect Node Caption

I'd super-recommend not trying to do both of these with one action. You'd need to solve this problem for almost every variable and it'll reduce visibility of what your ticket actually says and introduce complexity where it doesn't need to be. Your interface alerts could do cool interface specific stuff, checking discards or traffic or related network stuff. 

If you had to, using a case statement is probably the way.

CASE WHEN [type-producing-macro] = interface then x
WHEN  [type-producing-macro] = node then y

ELSE 'Fail'
End as thing

again reccomend not doing that

As suggested i ended up going with separate alert actions for Node and Interfaces 

As suggested i ended up going with separate alert actions for Node and Interfaces