Modern Dashboard - Last 25 Application Events

Question

I'm trying to figure out the SWQL that would recreate the "Last 25 Application Events" in the classic dashboard.  Should show the following: Timestamp, Status/Status Icon, Description

Examples:

4/9/2021 11:38 AMComponent "SQL Server Browser" for application "SQL Server Browser" on node "ServerA" is up

4/9/2021 11:33 AMApplication "SQL Server Browser" on node "ServerA" is in an unknown state

Seashore · Accepted Answer

Here is a start for you:

SELECT TOP 25
 E.EventTime, 
 E.NetworkNode, -- Related Nodeid
 E.NetObjectID, -- Related appid
 Message, 
 Acknowledged
 ,ET.Name -- Eventtype
 ,ET.Icon -- Eventtype icon
FROM Orion.Events AS E
INNER JOIN Orion.EventTypes AS ET ON E.EventType=ET.EventType
WHERE
 E.eventtype IN (SELECT EventTypeID FROM Orion.APM.EventType) --Only get the eventtypes for SAM
ORDER BY E.EventID desc -- Order by EventID instead of Eventtime, easier for SQL

Added some comments in the code so you know what the lines are for. Remove those that's not interesting. Hope it helps!