SolarWinds
Filter Syntax Guide
Technical Reference
Copyright © 1995-2015 SolarWinds Worldwide, LLC. All rights reserved
worldwide.
No part of this document may be reproduced by any means nor modified,
decompiled, disassembled, published or distributed, in whole or in part, or
translated to any electronic medium or other means without the written consent of
SolarWinds. All right, title, and interest in and to the software and documentation
are and shall remain the exclusive property of SolarWinds and its respective
licensors.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER
TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON
SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER
INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN,
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND
NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS,
NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING
IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF
SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
The SOLARWINDS and SOLARWINDS & Design marks are the exclusive
property of SolarWinds Worldwide, LLC and its affiliates, are registered with the
U.S. Patent and Trademark Office, and may be registered or pending registration
in other countries. All other SolarWinds trademarks, service marks, and logos
may be common law marks, registered or pending registration in the United
States or in other countries. All other trademarks mentioned herein are used for
identification purposes only and may be or are trademarks or registered
trademarks of their respective companies.
Filter Syntax Guide, Version 18, 2/24/2015
2
Table of Contents
Introduction to Resource Filtering
4
Filter Syntax
4
SQL or SWQL?
5
SWQL Filter Syntax Examples
5
Wildcards
5
Filtering by Custom Property
5
Filtering by Built-in Properties
5
Filtering by Status
6
SQL Filter Syntax Examples
6
Wildcards
6
Filtering by Custom Property
6
Examples
7
Filtering by Status
7
SWQL Resource Matrix
8
SolarWinds EOC Resources
8
SolarWinds SAM Resources
25
3
Introduction to Resource Filtering
When managing large numbers of network devices with Orion NPM, resources
that list Orion objects such as nodes and volumes can easily become very large
and difficult to navigate. To help you more easily navigate the contents of your
resources, we allow you to create filters.
Filters are optional database queries that you can add limit the Orion objects
listed inside a resource. You can apply filters based on any Orion object property,
be it custom or pre-defined within a resource, to help you better interpret the
monitoring data shown in the resources.
To apply a resource filter:
1. Click Edit in any resource that lists Orion objects.
2. Click Show Filter Examples > Show List of Properties to list the
properties you can use for the filter criteria.
3. Provide appropriate filter criteria in the Filter Nodes field, and then click
Submit.
Filter Syntax
There are two slightly different filter syntax types: Structured Query Language
(SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main
differences between SQL and SWQL are:
l
l
The SWQL wildcard character is %. The SQL wildcard character is *.
If the resource you are trying to filter creates its list by joining two tables
together that contain properties that share the same name, you cannot filter
on that property unless you attach a particular SQL table name to the
beginning of the property name. The same is true also for SWQL queries,
except you must look up the SWQL name and use that as a prefix instead of
a SQL table name.
4
Introduction to Resource Filtering
SQL or SWQL?
It is not always obvious whether a resource requires SQL syntax or SWQL syntax
filters. Generally, the resources that have most recently been added to
SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax.
Look for additional guidance at the bottom of the Edit Resource page in the form
of words such as "SWQL query" or "SQL query".
SWQL Filter Syntax Examples
The following sections detail how to filter in SWQL by using the most frequently
requested examples.
Wildcards
The wildcard character in SWQL syntax is: %.
Example: Node.Caption Like 'AX3%'
Filtering by Custom Property
The data types that support custom properties are:
l
Interface
l
Node
l
Volume
Use the SWQL alias for these data types when selecting custom properties for
your queries. The property syntax to filter by custom property is:
alias.CustomProperties.propertyName
Example filter to only show nodes with the custom property City that matches
Atlanta:
Node.CustomProperties.City = 'Atlanta'
Filtering by Built-in Properties
Use the SWQL alias when selecting properties for your queries.
Examples
Example filter to show data from Cisco devices:
Node.Vendor = 'Cisco'
5
Filtering by Status
Example filter to show data from Windows Server 2003-2008 applications:
Status.Application.Name = 'Windows Server 2003-2008'
Example filter to show data from devices beginning with "AX3":
Node.Caption Like 'AX3%'
Example filter to show data from Process Monitor – SNMP type component
monitors:
Monitor.ComponentType = 8
Filtering by Status
To filter by the status property, you must know the valid status levels.
Level
0
1
2
3
14
Status
Unknown
Up
Down
Warning
Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
SQL Filter Syntax Examples
The following sections detail how to filter in SQL by using the most frequently
requested examples.
Wildcards
The wildcard character in SQL syntax is: *.
Example: Node.Caption Like 'AX3*'
Filtering by Custom Property
The property syntax to filter by custom property is:
dataType.CustomProperty.propertyName
Example filter to only show nodes with the custom property City that matches
Atlanta:
Node.CustomProperty.City = 'Atlanta'
6
Introduction to Resource Filtering
Examples
Example filter to show only Cisco devices:
Vendor = 'Cisco'
Example filter to show data only from component monitors named Server Load
Monitor:
Monitor.Name like 'Server Load Monitor'
Example filter to show data from devices beginning with "AX3":
Node.Caption Like 'AX3*'
Example filter to show only Nortel devices that are Down:
Vendor Like 'Nortel*' AND Status=2
Filtering by Status
To filter by the status property, you must know the valid status levels.
Level
0
1
2
3
14
Status
Unknown
Up
Down
Warning
Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
7
SWQL Resource Matrix
SWQL Resource Matrix
The resource matrix helps you find the SWQL aliases you need to create filter
criteria for your resources. The SWIS entity names are provided so that you know
exactly how the SWQL alias maps to the SWIS entities in your SolarWinds
product databases.
l
SolarWinds EOC Resources
l
SolarWinds SAM Resources
SolarWinds EOC Resources
All SolarWinds Enterprise Operations Console (EOC) resources use SWQL
filtering.
Alert Resources
Resource
SWIS Entity Name
SWQL Alias
Global Last XX Active
Alerts
EOC.Alert2
Alert
EOC.Node
Node
EOC.Node.CustomProperty Node.CustomProperty
EOC.Orion
SWServer
Triggered Alerts for All EOC.Alert2
Network Devices
EOC.Node
Alert
Node
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion
SWServer
8
SWQL Resource Matrix
Event Resources
Resource
SWIS Entity Name
SWQL Alias
Global Events Summary
EOC.Event
Event
EOC.EventType
EventType
EOC.Orion
SWServer
EOC.Event
Event
EOC.EventType
EventType
EOC.Node
Node
EOC.Orion
SWServer
EOC.EventName
EventName
Resource
SWIS Entity Name
SWQL Alias
Global Active Group
Alerts
EOC.Alert2
Alert
EOC.Orion
SWServer
Global All Groups
EOC.Groups
Groups
EOC.Orion
SWServer
EOC.StatusInfo
StatusInfo
EOC.Groups
Groups
EOC.Orion
SWServer
Global Last XX Events
Groups Resources
Global Groups With
Problems
9
SolarWinds EOC Resources
Inventory Resources
Resource
SWIS Entity Name
SWQL Alias
Number of Interfaces by
Type
EOC.Interface
I
EOC.Orion
SWServer
Number of Nodes by
Device Type
EOC.Node
Node
EOC.Orion
SWServer
Number of Nodes by
IOS/OS
EOC.Node
Node
EOC.Orion
SWServer
SolarWinds EOC Resources
Resource
SWIS Entity Name
SWQL Alias
Global Top XX Errors &
Discards This Hour
EOC.Interface
I
EOC.Node
N
EOC.Orion
SWServer
EOC.Interface
I
EOC.Node
N
EOC.Orion
SWServer
EOC.Interface
I
EOC.Node
N
EOC.Orion
SWServer
EOC.Interface
I
EOC.Node
N
EOC.Orion
SWServer
Global Top XX Error &
Discards Today
Global Top XX
Interfaces by percent
utilization
Global Top XX
Interfaces by Relative
Multicast Packet Rate
10
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global Top XX
Interfaces by Traffic
EOC.Interface
I
EOC.Node
N
EOC.Orion
SWServer
Global Top XX Nodes
by Average Response
Time
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Nodes
by CPU Load
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Nodes
by Current Response
Time
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Nodes
by Percent Memory
Used
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Nodes
by Percent Packet Loss
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Volumes
by Disk Space Used
EOC.Node
N
EOC.Orion
SWServer
EOC.Volume
V
EOC.Volume.Stats
VS
11
SolarWinds EOC Resources
SolarWinds IPAM Resources
Resource
SWIS Entity Name
SWQL Alias
Global Top XX DHCP
Scopes by Utilization
EOC.IPAM.GroupNode
Scope
EOC.Orion
SWServer
Global Top XX Subnets
By % IP Address Used
EOC.IPAM.GroupNode
Subnet
EOC.Orion
SWServer
SolarWinds NCM Resources
Resource
SWIS Entity Name
SWQL Alias
Global
Configuration
Manager
Nodes
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
SWServer
Global
Devices
Backed Up vs
Not Backed
Up
EOC.NCM.ConfigArchive
ConfigArchive
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
SWServer
EOC.NCM.CacheDiffResults
CacheDiffResults
EOC.NCM.ComparisonCache
ComparisonCache
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
SWServer
Global Last
XX Config
Changes
12
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global Policy
Violations For
Each
SolarWinds
Server
EOC.NCM.LatestPolicyReportViolations LPR
EOC.NCM.PolicyReports
PR
EOC.Orion
O
SolarWinds NTA Resources
Resource
SWIS Entity Name
SWQL Alias
Global Last XX Traffic
Analysis Events
EOC.EventType
EventType
EOC.Node
Node
EOC.Orion
SWServer
Global NetFlow Sources EOC.Interface
NetFlow Collector
Services
I
EOC.Interface
I1
EOC.NetFlow.Source
S
EOC.NetFlow.Source
S1
EOC.Node
N
EOC.Node
N1
EOC.Orion
SWServer
EOC.NetFlow.Engine
S
EOC.Orion
SWServer
13
SolarWinds EOC Resources
SolarWinds SAM (APM) Resources
Resource
SWIS Entity Name
SWQL Alias
Global All
Applications
EOC.APM.Application
A
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
N
EOC.Node.CustomProperty
NodeCustomProperty
EOC.Orion
SWServer
EOC.APM.Application
Application
EOC.APM.CurrentApplicationStatus
Status
EOC.Node
Node
EOC.Orion
SWServer
Global
Application
Health
Overview
Global
EOC.APM.Application
Applications by
EOC.APM.ApplicationTemplate
Status
A
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
N
EOC.Node.CustomProperty
NodeCustomProperty
EOC.Orion
SWServer
14
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global
Applications
with High
Process CPU
Load
EOC.APM.Application
A
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.CurrentApplicationStatus
CAS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.CurrentApplicationStatus
CAS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
N
EOC.Orion
SWServer
Global
Applications
with High
Process
Memory Used
Global
Applications
with High
Response
Time
Global
Applications
with Issues
15
SolarWinds EOC Resources
Resource
SWIS Entity Name
SWQL Alias
Global Top XX
Monitors by
Response
Time
EOC.APM.Application
A
EOC.APM.Component
Monitor
Global Top XX
Process
Monitors by
CPU Load
Global Top XX
Process
Monitors by
Physical
Memory
Global Top XX
Process
Monitors by
Virtual Memory
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
EOC.APM.Application
A
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
N
EOC.Orion
SWServer
16
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Total
Applications
By Type for
Each Local
SolarWinds
Server
EOC.APM.ApplicationTemplate
AT
EOC.Orion
SWServer
SolarWinds UDT Resources
Resource
SWIS Entity Name
SWQL Alias
Global Total Ports
Currently Used
EOC.Orion
SWServer
Top XX Nodes by
Percent Ports Used
EOC.Node
N
EOC.Orion
SWServer
EOC.UDT.NodeCapability S
EOC.UDT.NodeStatistics
NS
SolarWinds VNQM (IP SLA) Resources
Resource
SWIS Entity Name
SWQL Alias
Global Active
IP SLA
Operation
Alerts
EOC.AlertDefinition
AlertDefinition
EOC.AlertStatus
AlertStatus
EOC.IpSla.Operation
IpSlaOperation
EOC.IpSla.OperationType
IpSlaOperationType
EOC.Orion
SWServer
17
SolarWinds EOC Resources
Resource
SWIS Entity Name
SWQL Alias
Global All IP
SLA
Operations
EOC.AlertStatus
AlertStatus
EOC.AlertDefinition
AlertDefinition
EOC.IpSla.Operation
IpSlaOperation
EOC.IpSla.OperationStatus
ipSlaOperationStatus
EOC.IpSla.OperationType
IpSlaOperationType
EOC.IpSla.Site
SourceSite
EOC.IpSla.Site
TargetSite
EOC.Node
Node
EOC.Orion
SWServer
EOC.Event
Event
EOC.IpSla.Event
IpSlaEvent
EOC.Orion
SWServer
EOC.IpSla.Operation
IpSlaOperation
Global Last XX
IP SLA Events
Global Top XX
All Operations
EOC.IpSla.OperationCurrentStat IpSlaOperationCurrentStat
EOC.IpSla.OperationStatus
ipSlaOperationStatus
EOC.IpSla.OperationType
IpSlaOperationType
EOC.IpSla.Site
SourceSite
EOC.IpSla.Site
TargetSite
EOC.Node
SourceNode
EOC.Node
TargetNode
EOC.Orion
SWServer
18
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global Top XX
Call Paths by
Jitter
EOC.Node
N1
EOC.Node
N2
EOC.Orion
SWServer
EOC.Voip.Link
L
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
D
EOC.Node
N1
EOC.Node
N2
EOC.Orion
SWServer
EOC.Voip.Link
L
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
D
EOC.Node
N1
EOC.Node
N2
EOC.Orion
SWServer
EOC.Voip.Link
L
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
D
Global Top XX
Call Paths by
Latency
Global Top XX
Call Paths by
MOS
19
SolarWinds EOC Resources
Resource
SWIS Entity Name
SWQL Alias
Global Top XX
Call Paths by
Packet Loss
EOC.Node
N1
EOC.Node
N2
EOC.Orion
SWServer
EOC.Voip.Link
L
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
D
EOC.Node
N1
EOC.Node
N2
EOC.Orion
SWServer
EOC.Voip.Link
L
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
D
EOC.Node
N
EOC.Orion
SWServer
EOC.Voip.CCMStatistic
C
EOC.Orion
SWServer
EOC.Voip.Engine
S
Global Top XX
VoIP Call
Paths
Global VoIP
Call Managers
Global VoIP
Collector
Services
20
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global VoIP
Sites Overview
EOC.IpSla.Operation
L
EOC.IpSla.OperationCurrentStat D
EOC.IpSla.OperationStatus
OperationStatus
EOC.IpSla.Site
S
EOC.Node
Node
EOC.Orion
SWServer
SolarWinds WPM Resources
Resource
SWIS Entity Name
SWQL Alias
Global All Locations
EOC.SEUM.Agent
A
EOC.Orion
O
Global All
Transactions
EOC.SEUM.Transaction
T
EOC.Orion
O
Global Steps With
Problems
EOC.SEUM.TransactionStep TS
Global Top XX Steps
by Duration
EOC.Orion
O
EOC.SEUM.Transaction
T
EOC.StatusInfo
s
EOC.StatusInfo
s2
EOC.SEUM.TransactionStep TS
EOC.Orion
O
21
SolarWinds EOC Resources
Resource
SWIS Entity Name
SWQL Alias
Global Top XX
Transactions by
Duration
EOC.SEUM.Transaction
T
EOC.Orion
O
Global Transaction
Health Overview
EOC.SEUM.Transaction
T
EOC.Orion
O
EOC.StatusInfo
S
EOC.SEUM.Transaction
T
EOC.Orion
O
EOC.StatusInfo
S
Global Transactions
With Problems
Summary Report Resources
Resource
SWIS Entity Name
SWQL Alias
Global Down Interface
EOC.Interface
I
EOC.Node
Node
EOC.Orion
SWServer
EOC.Node
Node
EOC.Orion
SWServer
Global High Errors &
Discards Today
EOC.Interface
I
EOC.Node
N
Global Node Status
by Site
EOC.Node
Node
Global Down Nodes
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion
SWServer
22
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Global Nodes with
High CPU Load
EOC.Node
Node
EOC.Orion
SWServer
Global Nodes with
High Memory
Utilization
EOC.Node
Node
EOC.Orion
SWServer
Global Nodes with
High Packet Loss
EOC.Node
Node
EOC.Orion
SWServer
Global Nodes with
High Response Time
EOC.Node
Node
EOC.Orion
SWServer
Global Top XX Nodes
with Problems
EOC.Node
Node
Global Volumes with
High Percent usage
SolarWinds Servers
Summary Statistics
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion
SWServer
EOC.Node
N
EOC.Orion
SWServer
EOC.Volume
V
EOC.Orion
SWServer
23
SolarWinds EOC Resources
SysLog Resources
Resource
SWIS Entity Name
SWQL Alias
SysLog Messages from
All Network Devices
EOC.Node
Node
EOC.Orion
SWServer
EOC.SysLog
SysLog
EOC.SysLogFacility
SysLogFacility
EOC.SysLogSeverity
SysLogSeverity
EOC.Orion
SWServer
EOC.SysLog
SysLog
Resource
SWIS Entity Name
SWQL Alias
Global Trap Resource
EOC.Orion
SWServer
EOC.Trap
Trap
EOC.Node
Node
EOC.Orion
SWServer
EOC.Trap
Trap
EOC.TrapVarbind
TrapVarBind
Resource
SWIS Entity Name
SWQL Alias
Global Wireless Clients
EOC.Node
N
EOC.Orion
SWServer
EOC.Wireless.Interface
WI
Syslog Summary
Trap Resources
Traps from All Network
Devices
Wireless Resources
24
SWQL Resource Matrix
Resource
SWIS Entity Name
SWQL Alias
Top XX Access Points
by Number of Clients
EOC.Node
N
EOC.Orion
SWServer
EOC.Wireless.Interface
WI
Top XX Wireless Clients EOC.Node
by Traffic Rate
EOC.Orion
N
SWServer
EOC.Wireless.Client
WC
SolarWinds SAM Resources
Resources for SolarWinds Server & Application Monitor (SAM) use a mix of
SWQL and SQL filters. Tables that start with APM_ are SQL tables and use SQL
filters. All the others are SWIS tables and use SWQL filtering.
SolarWinds SAM Resource Resources
Resource
Table Name
SWQL Alias
All Applications
Tree
Orion.APM.Application
Application
Orion.APM.ApplicationTemplate
ApplicationTemplate
Orion.APM.CurrentApplicationStatus Status
Orion.Nodes
Nodes
Applications with Orion.APM.Application
Problems
Orion.APM.ApplicationTemplate
Application
Template
Orion.APM.CurrentApplicationStatus Status
Orion.Nodes
Nodes
25
SolarWinds SAM Resources
Resource
Table Name
SWQL Alias
Top XX
Components by
Statistic Data
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
thresholdRT
APM_ThresholdsByComponent
thresholdStat
APM_ErrorCode
ec
APM_StatusCodeType
sct
APM_StatusCode
sc
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
Top XX
Components by
Response Time
Top XX
Processes by
CPU Load
26
SWQL Resource Matrix
Resource
Table Name
SWQL Alias
Top XX
Processes by
Physical
Memory
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
Top XX
Processes by
Virtual Memory
27