SWQL starters: Alerts, Nodes, Interfaces

Short skeleton queries for Alerts / Nodes / Interfaces — verify entities against your SWIS schema.

Sample SWQL below was drafted on Orion Platform 2024.4.1 — validate joins and fields in your lab before reuse.

Use the SWQL Copilot for drafts, then validate in SWQL Studio.

Alerts (active)

SELECT TOP 100 AlertObjects.AlertObjectID, AlertObjects.EntityUri, AlertObjects.DisplayName
FROM Orion.AlertObjects AS AlertObjects
WHERE AlertObjects.Active = 1
ORDER BY AlertObjects.AlertObjectID DESC

Nodes

SELECT n.NodeID, n.Caption, n.IPAddress, n.Status
FROM Orion.Nodes AS n
WHERE n.Status <> 2
ORDER BY n.Caption

Interfaces (example join)

SELECT i.InterfaceID, i.Caption, n.Caption AS NodeCaption
FROM Orion.NPM.Interfaces AS i
INNER JOIN Orion.Nodes AS n ON i.NodeID = n.NodeID
WHERE n.NodeID = @YourNodeId

For a fuller walkthrough (Chinese), switch locale — the slug matches the Chinese article.