From d2ad6a3965cacc69e1062f63c0e56be0bd7f7ca9 Mon Sep 17 00:00:00 2001 From: Blake Drumm Date: Wed, 8 May 2024 12:01:58 -0400 Subject: [PATCH] Use rendered description instead of raw description :dango: --- SQL Queries/Data Warehouse/DW_Events_ByTotalEvents.sql | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SQL Queries/Data Warehouse/DW_Events_ByTotalEvents.sql b/SQL Queries/Data Warehouse/DW_Events_ByTotalEvents.sql index d69bde9..4019296 100644 --- a/SQL Queries/Data Warehouse/DW_Events_ByTotalEvents.sql +++ b/SQL Queries/Data Warehouse/DW_Events_ByTotalEvents.sql @@ -11,12 +11,13 @@ -- -- Author: Blake Drumm (blakedrumm@microsoft.com) -- Date Created: May 7th, 2024 +-- Date Modified: May 8th, 2024 -- Original query: https://kevinholman.com/2016/11/11/scom-sql-queries/#:~:text=Events%20Section%20(Warehouse) ---------------------------------------------------------------------------------------------------------------- -- Selects the top 100 records from the result set SELECT TOP 100 evt.EventDisplayNumber, -- Display number of the event - evtd.RawDescription, -- Raw description of the event + evtd.RenderedDescription, -- Raw description of the event evtlc.ComputerName, -- Name of the computer logging the event COUNT(*) AS TotalEvents, -- Total number of events aggregated by display number, description, and computer name DATEDIFF(DAY, MIN(evt.DateTime), MAX(evt.DateTime)) + 1 AS DaysOfData -- Calculates the span of days between the earliest and latest event dates for each group @@ -30,7 +31,7 @@ INNER JOIN ON evt.LoggingComputerRowId = evtlc.EventLoggingComputerRowId GROUP BY evt.EventDisplayNumber, -- Groups the results by event display number, - evtd.RawDescription, -- raw event description, + evtd.RenderedDescription, -- raw event description, evtlc.ComputerName -- and computer name ORDER BY TotalEvents DESC -- Orders the results by the total number of events, in descending order