Differences in SWQL in EOC?

It appears to be something with FULL JOIN versus JOIN - but again only on SWQL on EOC.

I would welcome any thoughts.

And even with this simple SWQL query running against one node, I'm returning TWO results on EOC set to query against just one Orion, instead of the one that returns on the SWQL Studio on the Orion instance itself.  WHY?

select n.Caption, IP_Address, 
TOSTRING (ram.VolumeSize/1024/1024/1024) + ' GB' as RAM,  ram.VolumeType as RAMT
from Orion.Nodes n 
 
JOIN (select NodeID, VolumeSize, VolumeType from Orion.Volumes 
where VolumeType='RAM') 
ram 
on ram.NodeID=n.NodeID 
 
where n.CustomProperties.Department='Physician Services' 
and MachineType like '%WINDOWS%' 
and n.Caption=

Oddly the nested filter is not working in SWQL - when I return:

JOIN (select NodeID, VolumeSize, VolumeType from Orion.Volumes  
where VolumeType='RAM') 

It is not in fact filtering the sub-query based on the VolumeType.  It's returning both the entry for the RAM and a boot volume C: - despite C: being "fixed disk" in the database for that VolumeID.

Further looking at the subquery and the returned VolumeID, it appears that the VolumeID is not only not VolumeType='RAM', but also belongs to a different NodeID entirely, which means something weird is going on with the JOIN as well.

There also appears to be an error(?) where two values with the same column name cannot be selected, even if they are renamed:

select NodeID, v.Node.Caption, VolumeID, v.Caption, VolumeType, VolumeSize  
from Orion.Volumes v

This does not work on the EOC - it returns the last "caption" value twice.  However, this works correctly in the SWQL Studio.

mwb​ I will have a look at your examples and check with the engineering team to see where we can fill in some of the gaps and perhaps make improvements.  Thank you for providing all the details you have so far.  

mwb​ Here are a few suggestions:

1) Avoid missing table aliases in select statement: "select NodeID, v.Node.Caption from Orion.Volumes v" would be rewritten to "select v.NodeID, v.Node.Caption from Orion.Volumes v"

2) Avoid duplicated column names in select statement: "select v.Node.Caption, v.Caption from Orion.Volumes v" would be rewritten to  "select v.Node.Caption as NodeCaption, v.Caption as VolumeCaption from Orion.Volumes v"

3) To avoid data duplication when an entity with the same ID is present in multiple remote Orion Instances (Orion Sites), always use InstanceSiteId in JOIN statements. To explain, here is a simplified version of one your provided queries:

select n.Caption, TOSTRING (ram.VolumeSize/1024/1024/1024) + ' GB' as RAM,  ram.VolumeType as RAMT 

from Orion.Nodes n   

JOIN (select NodeID, VolumeSize, VolumeType from Orion.Volumes where VolumeType='RAM') ram  

on ram.NodeID=n.NodeID  

where n.MachineType like '%WINDOWS%'

When executing it over a single instance of Orion Site, it returns a correct result. But when executing the query from EOC when multiple Orion Sites are attached to it, EOC will return duplicated data. To avoid that data duplication, add InstanceSiteId into select statement of inner query (so that each Node is identified by both NodeID and InstaceSiteId) and ram.InstaceSiteId=n.InstaceSiteId condition to JOIN statement to avoid cross-site joins.

Another improvement to distinguish from which Orion Site data comes from, would be adding Site Name (n.OrionSite.Name) to the outer select statement.

The complete query would look as follows:

select n.Caption, TOSTRING (ram.VolumeSize/1024/1024/1024) + ' GB' as RAM,  ram.VolumeType as RAMT, n.OrionSite.Name as OrionName

from Orion.Nodes n   

JOIN (select NodeID, InstanceSiteId, VolumeSize, VolumeType from Orion.Volumes where VolumeType='RAM') ram  

on ram.NodeID=n.NodeID and ram.InstanceSiteId=n.InstanceSiteId   

where n.MachineType like '%WINDOWS%'

"2) Avoid duplicated column names in select statement: "select v.Node.Caption, v.Caption from Orion.Volumes v" would be rewritten to  "select v.Node.Caption as NodeCaption, v.Caption as VolumeCaption from Orion.Volumes v"

- well I'll be damned.  I swear that I labeled in the select statement and still ended up with a mess.  I'll go at this again and update.

Also this is a puritanical to censor "d---ed".

FULL JOIN for non-passthrough queries is now supported (internal issue PLA-80), for Core 2018.3 and later.