Hi all,
im trying to get the top 500 syslogs per some spefic nodes (not 500 total, 500 per node) and have been advised the below query should work with MSSQL, however SWQL is slightly different, currently the query fails with the error:
requests.exceptions.HTTPError: 400 Client Error: no viable alternative at input 'OVER' in Select clause for url: https://solarwinds-orion:17778/SolarWinds/InformationService/v3/Json/Query
so im guessing its not supported, is there an alternate method to achieve this?
SELECT n.NodeID as solarwinds_id, n.NodeName, n.Syslogs.MessageID, n.Syslogs.SysLogSeverity, n.Syslogs.Message, TOLOCAL(n.Syslogs.DateTime) as DateTime FROM ( SELECT n.NodeID as solarwinds_id, n.NodeName, n.Syslogs.MessageID, n.Syslogs.SysLogSeverity, n.Syslogs.Message, TOLOCAL(n.Syslogs.DateTime) as DateTime, ROW_NUMBER() OVER (PARTITION BY NodeId ORDER BY Syslogs.DateTime DESC) as seq FROM Orion.Nodes n WHERE Syslogs.DateTime > '2018-08-06 15:46:23.028792' AND NodeID IN (1845, 524, 38, 794, 35, 36) ) n WHERE seq <= 500 ORDER BY n.Syslogs.DateTime DESC;