Community FAQ
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
emitsupport
Engaged Sweeper

Hi

I do many reports where i report on event logs. suck as logon fails, log clears etc etc. many of them return results for wrong time frame. 

 

This example below produces a report containing events that occured some 5 days ago. but should just return last day.

 

Any pointers please? 

 

Select Top 1000000 tblAssets.AssetName,
Count(tblNtlog.EventlogID) As NumberOfEvents,
tblNtlog.Eventcode,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblNtlog.TimeGenerated,
tblAssets.Username
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Where (tblNtlogSource.Sourcename = 'Microsoft-Windows-Eventlog' And
tblNtlog.TimeGenerated > GetDate() - 1 And tblAssetCustom.State = 1) Or
(tblNtlogSource.Sourcename = 'Microsoft-Windows-Eventlog')
Group By tblAssets.AssetName,
tblNtlog.Eventcode,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblNtlog.TimeGenerated,
tblAssets.Username
Having (tblNtlog.Eventcode = 1102) Or
(tblNtlog.Eventcode = 104)

 

 

1 REPLY 1
Mister_Nobody
Honored Sweeper II

 

 

Where (tblNtlogSource.Sourcename = 'Microsoft-Windows-Eventlog' 
 Or
tblNtlogSource.Sourcename = 'Microsoft-Windows-Eventlog')
 and tblNtlog.TimeGenerated > GetDate() - 1 And tblAssetCustom.State = 1

 

 

Reports & Analytics

Ask about reports you're interested in and share reports you've created. Subscribe to receive daily updates of reports shared in the Community.

New to Lansweeper?

Try Lansweeper For Free

Experience Lansweeper with your own data.
Sign up now for a 14-day free trial.

Try Now