This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Events - Difference between SWIS API and SWQL

Hello,

I have written an application to read events using SWIS API on regular interval(e.g every 30 seconds) and pass it to ticketing system from other vendor.

API Query is :

https://<<SERVERIP>>:<<PORT>>/SolarWinds/InformationService/v3/Json/Query?query=SELECT n.IP_Address, e.Message, e.NetObjectID,n.EntityType, n.Description, n.DetailsUrl, n.Caption, n.DetailsUrl, e.EventTime,et.Name, e.Message FROM Orion.Events e INNER JOIN Orion.Nodes n ON e.NetworkNode = n.NodeID INNER JOIN Orion.EventTypes et ON e.EventType = et.EventType WHERE et.EventType NOT IN (506,504,11,519,529,524) and e.EventTime>='2019-05-27 18:30:00'

Note: I am using Orion.Events.EventTime in where condition to get only differential events.

Issue : The number events is very less compare to the below query executed in SWQL. I have tried many times and there is difference in all the time

SELECT n.IP_Address, e.Message, e.NetObjectID,n.EntityType, n.Description, n.DetailsUrl, n.Caption, n.DetailsUrl, e.EventTime,et.Name, e.Message FROM Orion.Events e INNER JOIN Orion.Nodes n ON e.NetworkNode = n.NodeID INNER JOIN Orion.EventTypes et ON e.EventType = et.EventType WHERE et.EventType NOT IN (506,504,11,519,529,524) and e.EventTime>='2019-05-27 18:30:00'

Support Expected: How to ensure that my application does not miss any events generated in SolarWinds

  • Doing things based on times can be tricky in distributed systems since the system clocks on each machine aren't perfectly synchronized.  You might need to set the EventTime in your WHERE clause to look a bit further back (perhaps the last 5 minutes) and then use the EventID to avoid sending the same event to the ticketing system twice.  If you retrieve all the events in the last 5 minutes, discard event IDs that you've already sent, and then send the new ones (the ones left after discarding), you may get better results.