cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Event Code Report Question

books_lans
Engaged Sweeper
I have the report below to get occurrences of event code 4670 in the last day. How can I edit the report so it tells me the asset (computer )and number of times the event happened on each asset?

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Description,
tblNtlog.Eventcode,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblNtlog.TimeGenerated,
tblNtlogUser.Loguser
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.Eventcode = 4670 And tblNtlog.TimeGenerated > GetDate() - 1 And
tblAssetCustom.State = 1
Order By tblAssets.AssetName
1 REPLY 1

Hendrik_VE
Champion Sweeper II
Select Distinct Top 1000000 tblAssets.AssetName,
Count(tblNtlog.TimeGenerated) As Instances
From tblAssets
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Where tblNtlog.TimeGenerated > GetDate() - 1 And tblNtlog.Eventcode = 4670
Group By tblAssets.AssetName


Save it as "Chart: Event Coede 4670" and you see a chart in your dashboard.