Hi,
I'm trying to change this SWQL query I've found (and it works fine!!) to remove the minutes of downtime outside working hours (8:00 to 16:00) when the Down Event is before 8:00 or Up Event is after 16:00.
I believe I have to do a CASE but haven't figured out how,
Can someone help?
select n.caption as [Device]
-- shows the current status icon
, '/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Device]
-- makes a clickable link to the node details
, n.DetailsUrl as [_linkfor_Device]
,n.status
,n.childstatus
-- shows the timestamp of the down event, if there is no timestamp then is says the event was greater than the number of days in your event retention settings
, isnull(tostring(t2.[Down Event]),concat('Greater than ',(SELECT CurrentValue FROM Orion.Settings where settingid='SWNetPerfMon-Settings-Retain Events'),' days ago')) as [Down Event]
-- shows the timestamp of the up event, unless the object is still down
, isnull(tostring(t2.[Up Event]),'Ainda em baixo') as [Up Event]
-- figures out the minutes between the down and up events, if the object is still down it counts from the down event to now, displays 99999 if we cannot accurately determine the original downtime, and
, isnull(MINUTEDIFF(t2.[Down Event], isnull(t2.[Up Event],GETDATE())),99999) as Minutos
from orion.nodes n
left join (SELECT
-- Device nodeid used for our join
StartTime.Nodes.NodeID
-- Down Event time stamp in local time zone
,ToLocal(StartTime.EventTime) AS [Down Event]
-- Up Event time stamp in local time zone
,(SELECT TOP 1
ToLocal(EventTime) AS [EventTime]
FROM Orion.Events AS [EndTime]
-- picks the first up event that is newer than the down event for this node
WHERE EndTime.EventTime >= StartTime.EventTime
-- EventType 5 is a node up
AND EndTime.EventType = 5
AND EndTime.NetObjectID = StartTime.NetObjectID
AND EventTime IS NOT NULL
ORDER BY EndTime.EventTime
) AS [Up Event]
-- This is the table we are querying
FROM Orion.Events StartTime
-- EventType 1 is a node down
WHERE StartTime.EventType = 1
) t2 on n.NodeID = t2.nodeid
-- this is how I catch nodes that are down but have aged out of the events table
where (n.status = 2 or t2.nodeid is not null)
and (t2.[down event] > addday(-1,getdate()) and t2.[down event] < addday(0,getdate()) )
-- If you want to filter the results to only show outages of a minimum duration uncomment the below line
--and MINUTEDIFF(isnull(t2.[Down Event],(GETUTCDATE()-30)), isnull(t2.[Up Event],GETUTCDATE())) > 60
-- if you want to use this query in a search box of the Custom Query resource uncomment the below line
and n.Caption like 'rt%'
-- Isto garante que apenas os eventos entre as 08:00 e as 16:00 são apanhados
and hour(t2.[down event]) <= 15
and hour(t2.[up event]) >= 8
order by t2.[down event] desc