How can I count the number of syslog events in the past 24 hours?

Question

I have been trying to figure out how to create a report or SWIS query to tell me the number of syslog events in the past 24 hours each of my nodes have reported to syslog. When I look at the Syslog in Solarwinds, it has the count but only for the first 10 or so alphabetically. I want to see something that would let me know how many syslog events have happened in the last X hours. 
 Is there something that would tell me that or some way to create a report for this?

KMSigma.SWI · Accepted Answer

SELECT COUNT([Logs].LogEntryID) AS [MessageCount]
 , [Logs].LogMessageSource.OrionNode.Caption
FROM Orion.OLM.LogEntry AS [Logs]
WHERE [Logs].LogEntryTypeID = 1 -- Syslogs
 AND HourDiff([Logs].DateTime, GETUTCDATE()) < 24
GROUP BY [Logs].LogMessageSource.OrionNode.Caption
ORDER BY COUNT([Logs].LogEntryID) DESC

How can I count the number of syslog events in the past 24 hours?

Top Replies