I am trying to take an SQL Query and plug it into the SWQL Custom Query on one of our Orion views.
this is what i have.. replaced names in brackets..
use [database]
SELECT ComputerName, SourceName, Message
from dbo.APM_WindowsEvent_Detail
where ComputerName IN ('[list of all our domain controllers]')
and message like '%locked out%';
in the SQL manager this gives a report of all account lockouts... the goal is to have a solarwinds page for the help desk where they can go Search the username and see what device caused the lockout on any of the domain controllers..
any help is greatly appreciated.
thanks you.
Also, where can one download the SWQL Studio I have read about in other posts?