Hi All,
Seems like some of my SWQL scripts stopped working in 2018.4. One example is the one listed below. It works in 2018.2.1 SP1, but in 2018.4, it gives the following error: Incorrect syntax near '='. The offending line seems to be:
count(case when ((ah.EventType=6) and (act.ActionTypeID like '%email%') and (act.Enabled=1)) then 1 else 0 end) as [Email Success]
Seems like it's not interpreting the AND condition between ah.eventtype and act.actiontypeid. I've looked through the informationservices logs and it simply says that there is a syntax error with no other information. When I take out the AND conditions, it works.
I tried a few variations and they are all failing.
count(case when (ah.EventType=6) then (case when (act.ActionTypeID like '%email%' and act.Enabled = 1) then 1 else 0 end) else 0 end) as [Email Success]
However, put the same script in 2018.2.1 SP1 (NPM 12.3) - it works.
Any ideas on this??
SELECT
ah.AlertObjects.AlertConfigurations.Name as [Alert Name]
,count(case when ah.eventtype=0 then 1 else 0 end) as [Triggered]
,count(case when ah.EventType=1 then 1 else 0 end) as [Reset]
,count(case when ah.EventType=6 then 1 else null end) as [Action Success]
,count(case when ((ah.EventType=6) and (act.ActionTypeID like '%email%') and (act.Enabled=1)) then 1 else 0 end) as [Email Success]
FROM Orion.AlertHistory ah
left join Orion.Actions act on act.ActionID=ah.ActionID
where DAYDIFF(tolocal(ah.TimeStamp),GETDATE()) =0 and ah.AlertObjects.AlertConfigurations.Name is not null
group by ah.AlertObjects.AlertConfigurations.Name
order by [Triggered] desc
Thanks
Amit