I am having an issue validating a Custom SWQL Alert. This alert is true when Port 1 (primary) is down and Port 2 (secondary) is up.
We are unable to do this from the GUI because we have ~1800 of these SD-WAN boxes.
This is the query that is failing:
SELECT NodeID ,N.Caption FROM Orion.Nodes N
INNER JOIN Orion.NPM.Interfaces I
ON N.NodeID = I.NodeID
WHERE N.Caption LIKE '%-CGX' AND ((I.Caption = '1' AND I.Status = '2') OR (I.Caption = '2' AND I.Status = '1'))
GROUP BY NodeID,Caption HAVING Count(*)>1
But i get these results (which are correct) when i run it in SWQL studio:
Why is the validation failing when it successfully executes in SWQL Studio?