• State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 39 subscribers
  • Views 921 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SWQL Query Assistance

s-bolyard

Hello,

Just pulled out the last remaining hairs out of my head. 

s-bolyard_0-1589318519752.gif

I'm having some trouble with a SWQL query, specifically on adding a date parameter in the WHERE clause.  The query is meant to display any devices that encounter a reboot event ID for the last 24 hours. When I run the query, I receive data, but the query continues to run until I get the time out error.  Is there something in the query that I'm missing or should I adjust it, or use something else?

SELECT ComputerName AS [Name],EventCode AS [Event Code],User,Message,ToLocal(TimeGeneratedUtc) AS [ALERT TRIGGER TIME]
FROM Orion.APM.WindowsEvent
WHERE TimeGeneratedUtc > ADDDAY(-1, GETUTCDATE())
AND EventCode IN ('1074','41','1076','6006','6008')
ORDER BY TimeGeneratedUtc desc

s-bolyard_1-1589318869822.png

  • 0
    I'm not in front of my system right now, but I'm sure you would normally do something like:
    WHERE DAYDIFF(TimeGeneratedUtc, GETUTCDATE()) = '1'
  • 0

    Hi

    I tried your code in my environment and it ran fine. Result in half a second. This SQL table is about 2,5 million rows (dbo.APM_WindowsEvent_Detail). There is no index on EventCode in SQL so if you have many rows it might take a while.

    But, I made one change.

    The eventCode is an integer and should not be in '', so "EventCode IN (1074,41,1076....)"

  • 0

    In any swql that we use a date range then we have the following line

    WHERE 'xxxxxxx' > ADDDATE('day', -X, GETUTCDATE())

    where the 'X' in the number of days you want to go back and 'xxxxxxx' is the variable you are using, in this case TimeGeneratedUtc

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.