I have a custom chart showing the number of times particular alerts have triggered over the last 30 days. The original query I've copied from a post by marcnetterfield a long time ago but lost the source.
The problem is the chart doesn't line up with the output of the SWQL query in table form and I'm missing entries on the chart. In the screenshot below, the table and chart datasource is the same SWQL query. There are 8 unique alert names and the highlighted 4 are not shown on the chart. Of the alerts shown in the chart, the values match up exactly with the table excluding the missing alerts.
Edit: Pasting an image on thwack is painful. It resizes and distorts or blurs it into an unrecognisable mess. I've tried 5 different times to paste the below image in or used the Insert Image and it ends up worse each time.
So here is an imgur link: https://imgur.com/3QRqnla
Any thoughts of what I'm missing here? Bad SWQL as a datasource?
SELECT
ah.alertobjects.AlertConfigurations.Name AS [Alert Name]
,COUNT(Message) as [Alert Count]
,DATETRUNC('day',Timestamp) as [Date]
FROM Orion.AlertHistory ah
where EventType = 0
and DAYDIFF(timestamp, GetDate()) < 30
and ah.alertobjects.AlertConfigurations.Name LIKE '%Sev%'
GROUP BY ah.alertobjects.AlertConfigurations.Name, DATETRUNC('day',timestamp)
ORDER BY ah.alertobjects.AlertConfigurations.name
