2 Replies Latest reply on Apr 28, 2017 12:53 PM by tdanner

    How to remove duplicated audit events




      Can you show me how to remove duplicated audit events from this query?


      SELECT o.TimeLoggedUtc, o.AccountID, o.AuditEventMessage, n.DisplayName, o.AuditingActionType.ActionTypeDisplayName, cp.OS_Environment, cp.os_admin, cp.site_name, cp.mute_node, n.ipaddress, cp.os_type, cp.Site_Server_Room_Rak, cp.Site_Server_Room_Row, n.status, n.childstatus, n.DetailsUrl, o.networknode, n.nodeid

      FROM Orion.AuditingEvents o 

      left JOIN Orion.Nodes n ON o.NetworkNode=n.NodeID 

      left join orion.nodescustomproperties cp ON o.networknode=cp.nodeid

      WHERE cp.mute_node = 'true' and AuditEventMessage like '%Mute_Node% to %True%' and NetworkNode is not NULL and ActionTypeID = 30

      order by TimeLoggedUtc DESC 



      I know there's a new built-in Mute feature with SAM 6.4, however I can't transition to that method yet, so thanks in advance.

        • Re: How to remove duplicated audit events

          More clarification:  I need to add in a resource view to show a custom property node if it is muted and at the same time, show the account which muted the node.  However, running this swql query resulted in an "audit type event" which will show multiple event of node being muted.

          Can I add this custom resource view to show only 1 instance of the Node name, or IP?