This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Issue with custom SWQL Alert Query

I am having an issue validating a Custom SWQL Alert. This alert is true when Port 1 (primary) is down and Port 2 (secondary) is up.

We are unable to do this from the GUI because we have ~1800 of these SD-WAN boxes.

This is the query that is failing:

SELECT NodeID ,N.Caption FROM Orion.Nodes N

INNER JOIN Orion.NPM.Interfaces I

ON N.NodeID = I.NodeID

WHERE N.Caption LIKE '%-CGX' AND ((I.Caption = '1' AND I.Status = '2') OR (I.Caption = '2' AND I.Status = '1'))

GROUP BY NodeID,Caption HAVING Count(*)>1

pastedImage_0.png

But i get these results (which are correct) when i run it in SWQL studio:

pastedImage_1.png

Why is the validation failing when it successfully executes in SWQL Studio?