So I am trying to write an SWQL query that shows me all nodes that are unmanaged with some extra information tagged in, like Who unmanaged the node and When. OK, I wrote a nice little SWQL query like this:
SELECT DISTINCT N.Caption AS NodeCaption, N.ChildStatus AS ChildStatus, N.Status AS NodeStatus, ToLocal(N.UnmanageFrom) AS UnManageFrom, ToLocal(N.UnmanageUntil) AS UnManageUntil, ToLocal(AE.ObservationTimestamp) AS UnManagedWhen, AE.AccountID AS Who
FROM Orion.Nodes N
LEFT OUTER JOIN Orion.AuditingEvents AS AE
ON AE.AuditEventMessage LIKE CONCAT ('% unmanaged node ', N.Caption, '.')
INNER JOIN Orion.AuditingActionTypes AS AT
ON AE.ActionTypeID = AT.ActionTypeID
WHERE ((N.Unmanaged = 'True' OR N.UnmanageFrom >= GetUtcDate())
AND AT.ActionTypeDisplayName LIKE '%Node unmanaged%')
GROUP BY N.Caption, N.ChildStatus, N.Status, N.UnmanageFrom, N.UnmanageUntil, AE.ObservationTimestamp, Who
ORDER BY N.Caption ASC, UnManagedWhen DESC
That works great but I am getting multiple entries for nodes which have been managed/unmanaged multiple times in past. OK, so I rewrote the query slightly like this;
SELECT DISTINCT N.Caption AS NodeCaption, N.ChildStatus AS ChildStatus, N.Status AS NodeStatus, ToLocal(N.UnmanageFrom) AS UnManageFrom, ToLocal(N.UnmanageUntil) AS UnManageUntil, MAX(ToLocal(AE.ObservationTimestamp)) AS UnManagedWhen, AE.AccountID AS Who
FROM Orion.Nodes N
LEFT OUTER JOIN Orion.AuditingEvents AS AE
ON AE.AuditEventMessage LIKE CONCAT ('% unmanaged node ', N.Caption, '.')
INNER JOIN Orion.AuditingActionTypes AS AT
ON AE.ActionTypeID = AT.ActionTypeID
WHERE ((N.Unmanaged = 'True' OR N.UnmanageFrom >= GetUtcDate())
AND AT.ActionTypeDisplayName LIKE '%Node unmanaged%')
GROUP BY N.Caption, N.ChildStatus, N.Status, N.UnmanageFrom, N.UnmanageUntil, Who
ORDER BY N.Caption ASC, UnManagedWhen DESC
Well, that's pretty close to what I want but I still see that there are multiple entries for nodes which had had different users (AccountID) doing manage/unmanage. If the user was the same, all duplicates disappear and I get what I want. How do I further filter out results so I get the listing of all nodes that are currently unmanaged but I only get listing of the LATEST occurrence when this unmanaging happened and the user who did that.
Thanks.