Node Remove from SolarWinds Monitoring Environment

Hi ImNishat , I have a dashboard with containing a Custom Query widget that utilises SWQL for things like this that you might find useful. Here is the SWQL query I use below, of course you don't need to create a dashboard/widget, you can use Reports or SWQL Studio to get the information you require, the dashboard is just something you can pull up quickly for instances like this:

SELECT AuditEventID, ToLocal(TimeLoggedUtc) as [Date], AccountID, ActionTypeID, AuditEventMessage, NetworkNode, NetObjectID, NetObjectType, DetailsUrl, DisplayName
FROM Orion.AuditingEvents

WHERE TimeLoggedUtc > (GetDate()-120)

ORDER BY TimeLoggedUtc desc

The query is gathering audit events from the last 120 days (adjust to whatever timeframe you require), and sorting it by date/time.

Should your audit even retention allow for it, you can use this to go back and find the audit event message that mentions which user deleted the node in question.

--t.m-k

Thanks for your response, I will check this and update you.

Sure thing

Your given query does not work. So I used the below query it works but it required manual intervention to change the date format.

SELECT TOP 1000
AuditEventID,
ToLocal(TimeLoggedUtc) AS LocalTime,
AccountID,
AuditEventMessage
FROM
Orion.AuditingEvents
WHERE
AuditEventMessage LIKE '%deleted node%'
AND TimeLoggedUtc >= '2024-03-13'     --- Need to change this date time to time.
ORDER BY
TimeLoggedUtc DESC;

Your given query does not work. So I used the below query it works but it required manual intervention to change the date format.

SELECT TOP 1000
AuditEventID,
ToLocal(TimeLoggedUtc) AS LocalTime,
AccountID,
AuditEventMessage
FROM
Orion.AuditingEvents
WHERE
AuditEventMessage LIKE '%deleted node%'
AND TimeLoggedUtc >= '2024-03-13'     --- Need to change this date time to time.
ORDER BY
TimeLoggedUtc DESC;

Hi ImNishat, the query does work, I have just tested it again as-is in SWQL studio. Just ensure you are using SWQL supported widget/report/template or SWQL studio.

--t.m-k

I run the above your query again, but it's not working. Please see the below snapshot FYR.

It looks like you copied a little too much so the last line you have, either remove it or comment it out.

I corrected it... and it's working, but it's also giving me data from last year.

Glad it is working. I can just barely make out the 2024 in your screenshot which is this year but perhaps there is more data in there showing last year.

There are far more clever and experienced people on this forum especially since I've only been working with SW for a couple months. But this is typically where I would recommend some basic troubleshooting steps, e.g. change the date time from say 

lol

I have limited familiarity with software (SW), especially with SQL and SWQL. I have been working with SW for the past year.