Time Frame option for SWQL resource in Views!

Thanks for sharing query jm_sysadmin​,

This is good, but as you mentioned i'm asking this for read-only users and also it would be easier for admins also instead of editing queries.

Basically i need the Time Frame option what we will see in reports for custom tables.

I don't have an example for Avg CPU over 2 hours, but since SWQL can handle dates and time you could just write it into the query. I not taking an average below, but you easily could. I am however limiting the records to the last 24 with "HourDiff(ToLocal(AlertHistory.TimeStamp), GETDATE())  < 24"
==============================================================================================

Start SQWL

==============================================================================================

SELECT

     AlertHistory.AlertObjects.Node.Caption as Device,

     AlertHistory.AlertObjects.Node.CustomProperties.Support_Group as [Support Group],

     AlertHistory.AlertObjects.EntityCaption as [Triggering Entity],

     AlertHistory.Message,

     Case

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 0  Then 'Sunday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 1  Then 'Monday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 2  Then 'Tuesday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 3  Then 'Wednesday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 4  Then 'Thursday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 5  Then 'Friday'

          When WeekDay(ToLocal(AlertHistory.TimeStamp)) = 6  Then 'Saturday'

          Else ''

     End AS [Week Day],

     Case

          When Length(ToString(Minute(ToLocal(AlertHistory.TimeStamp)))) = 1  Then (tostring(Hour(ToLocal(AlertHistory.TimeStamp)))+':0' +(ToString(Minute(ToLocal(AlertHistory.TimeStamp)))) )

          Else (tostring(Hour(ToLocal(AlertHistory.TimeStamp)))+':' +(ToString(Minute(ToLocal(AlertHistory.TimeStamp)))) )

     End AS [Time of Day]

FROM Orion.AlertHistory AlertHistory

WHERE

      AlertHistory.eventtype = '0' and HourDiff(ToLocal(AlertHistory.TimeStamp), GETDATE())  < 24 AND

     AlertHistory.Message not like '%Datastore High Latency%' AND

     AlertHistory.AlertObjects.Node.CustomProperties.NodeUsedFor = 'Production'

Order by TimeStamp DESC

==============================================================================================

End SWQL

==============================================================================================

Let me know if you think that helps, or if you need more direction on using timestamps in SWQL resources. If you want non-admin editors to chage it you may be out of luck with out the request, but then I would point them to Perfstack.