Need SWQL Assistance on VPN Connection Counts

I able to use the following SWQL Query to get a total session count for all my VPN appliances.

SELECT DISTINCT

count ([data].[RemoteAccessSessions].[UserName]) AS [Total Sessions]
FROM orion.asa.node AS data
where [data].[RemoteAccessSessions].[EncryptionAlgorithm] = 1
and ([data].[RemoteAccessSessions].[NodeId] = XXX or [data].[RemoteAccessSessions].[NodeId] = XXX or [data].[RemoteAccessSessions].[NodeId] = XXX or [data].[RemoteAccessSessions].[NodeId] = XXX) and [data].[RemoteAccessSessions].[DisconnectedTime] is null

However, I would like to also display the individual count for each node in the same SWQL Query as well. 


Total Session = ### , Node 1 Sessions = ###, Node 2 Sessions = ###

Parents Reply Children
  • FYI, I was able to figure this out on my own with a little help from ChatGPT,  here is what the final results look like

    SELECT

        COUNT(CASE

                  WHEN [data].[RemoteAccessSessions].[EncryptionAlgorithm] = 1

                       AND ([data].[RemoteAccessSessions].[NodeId] = XX11 OR

                            [data].[RemoteAccessSessions].[NodeId] = XX21 OR

                            [data].[RemoteAccessSessions].[NodeId] = XX12 OR

                            [data].[RemoteAccessSessions].[NodeId] = XX22)

                       AND [data].[RemoteAccessSessions].[DisconnectedTime] IS NULL

                  THEN [data].[RemoteAccessSessions].[UserName]

              END) AS [Total Sessions],

        COUNT(CASE

                  WHEN [data].[RemoteAccessSessions].[EncryptionAlgorithm] = 1

                       AND ([data].[RemoteAccessSessions].[NodeId] = XX11 OR

                            [data].[RemoteAccessSessions].[NodeId] = XX12)

                       AND [data].[RemoteAccessSessions].[DisconnectedTime] IS NULL

                  THEN [data].[RemoteAccessSessions].[UserName]

              END) AS [Data Center1 Sessions],

        COUNT(CASE

                  WHEN [data].[RemoteAccessSessions].[EncryptionAlgorithm] = 1

                       AND ([data].[RemoteAccessSessions].[NodeId] = XX21 OR

                            [data].[RemoteAccessSessions].[NodeId] = XX22)

                       AND [data].[RemoteAccessSessions].[DisconnectedTime] IS NULL

                  THEN [data].[RemoteAccessSessions].[UserName]

              END) AS [Data Center2 Sessions]

    FROM

        orion.asa.node AS data

  • I am getting no results from the query.  I have only one Cisco 5525x ASA.  Can you help? 

  • I have single ASA using this code with an error. 

    SELECT
    COUNT(CASE
    WHEN [data].[RemoteAccessSessions].[EncryptionAlgorithm] = 1
    AND ([data].[RemoteAccessSessions].[NodeId] = 204
    AND [data].[RemoteAccessSessions].[DisconnectedTime] IS NULL
    THEN [data].[RemoteAccessSessions].[UserName]
    END) AS [Total Sessions],
    FROM
    orion.asa.node AS data