Extracting IPSLA status changes with SWQL query

I haven't tested this yet, but have you checked if the events table records anything for status changes?   I find in almost all cases it is much more practical to look for an event in the history than to try and parse every data point in the historical data.

Hi,

yes, that was my first approach.  From what I can see, it's only recorded in the event history if there is an Alert configured.

Therefore my first approach was to configure alerts and track the trigger and reset times.

This works, but creates a whole bunch of unwanted alerts.  I was looking for an approach that didnt require alerts.

If anyone knows a way of getting these events into the event log without configuring alerts - please shout!

Makes sense, I've had environments where we just set up informational alerts and then I edited all the views so informational alerts don't show, but it was kind of an elaborate scheme.

This is untested, but something like this might work.  It will likely be slow, though:

SELECT
    oa.OperationInstanceID,
    oa.RecordTime,
    oa.OperationStatusID
FROM Orion.IpSla.OperationAvailability oa
WHERE oa.OperationStatusID <>
(
    SELECT TOP 1
        oap.OperationStatusID
    FROM Orion.IpSla.OperationAvailability oap
    WHERE oa.OperationInstanceID = oap.OperationInstanceID AND oa.RecordTime > oap.RecordTime
    ORDER BY oap.RecordTime DESC
)

I've tried almost exactly that.  Unfortunately it doesn't work.  Some further investigation leads me to believe that SWQL doesn't support subqueries in the WHERE clause (only in SELECT and JOIN clauses)