Function Type Function Name

Check Values Min

Check Values Max
Check Values Avg
Check Values Sum
Check Values Count
Check Values Abs
Check Values IsNull
Date Time Get Date
Date Time GetUtcDate

Date Time DateTime

Date Time ToLocal

Date Time ToUtc

Date Time DateTrunc

Date Time ChangeTimeZone

Check Date Year

Check Date QuarterOfyear
Check Date DayOfYear
Check Date WeekDay
Check Date Month
Check Date Week
Check Date Day
Check Date Hour
Check Date Minute
Check Date Second
Check Date Millisecond

Add to Current DateTime AddDate

Add to Current DateTime AddYear

Add to Current DateTime AddMonth
Add to Current DateTime AddWeek
Add to Current DateTime AddDay
Add to Current DateTime AddHour
Add to Current DateTime AddMinute
Add to Current DateTime AddSecond
Add to Current DateTime AddMillisecond

Difference from Current DateTime YearDiff

Difference from Current DateTime MonthDiff

Difference from Current DateTime WeekDiff
Difference from Current DateTime DayDiff
Difference from Current DateTime HourDiff
Difference from Current DateTime MinuteDiff
Difference from Current DateTime SecondDiff

Difference from Current DateTime MillisecondDiff

Difference from Current DateTime Floor

Difference from Current DateTime Ceiling

Difference from Current DateTime Round

String ToString

String EscapeSWISUriValue

String SplitStringToArray
String ToUpper
String ToLower
String Concat
String SubString
String Length

Array ArrayLength

Array ArrayValueAt
 SWQL Example
SELECT min(SWISColumn) as ResultColumn FROM SWISTable
SELECT max(SWISColumn) as ResultColumn FROM SWISTable
SELECT avg(SWISColumn) as ResultColumn FROM SWISTable
SELECT sum(SWISColumn) as ResultColumn FROM SWISTable
SELECT count(SWISColumn) as ResultColumn FROM SWISTable
SELECT abs(-1) as ResultColumn FROM SWISTable
SELECT Restart, IsNull(restart, '9/25/2015 3:49:54') as ColumnResult FROM
Orion.Engines
SELECT getdate() as ResultCoumn FROM Orion.Engines
SELECT GetUtcDate() as ResultColumn FROM Orion.Engines
SELECT KeepAlive FROM Orion.Engines where KeepAlive > DateTime('9/25/2015
3:49:54')
SELECT Tolocal(getutcdate()) as ResultColumn FROM Orion.Engines
SELECT ToUtc(getdate()) as ResultColumn FROM Orion.Engines

SELECT DateTrunc('month', KeepAlive) as ColumnResult FROM Orion.Engines

SELECT ChangeTimeZone(KeepAlive,'+05:00') as ColumnResult FROM Orion.Engines

SELECT Year(KeepAlive) as ColumnResult from orion.engines

SELECT QuarterofYear(KeepAlive) as ColumnResult from orion.engines
SELECT DayofYear(KeepAlive) as ColumnResult from orion.engines
SELECT WeekDay(KeepAlive) as ColumnResult from orion.engines
SELECT Month(KeepAlive) as ColumnResult from orion.engines
SELECT Week(KeepAlive) as ColumnResult from orion.engines
SELECT Day(KeepAlive) as ColumnResult from orion.engines
SELECT Hour(KeepAlive) as ColumnResult from orion.engines
SELECT Minute(KeepAlive) as ColumnResult from orion.engines
SELECT Second(KeepAlive) as ColumnResult from orion.engines
SELECT MilliSecond(KeepAlive) as ColumnResult from orion.engines

SELECT AddDate('month', 2, KeepAlive) AS ColumnResult From Orion.Engines

SELECT AddYear(5, KeepAlive) AS ColumnResult From Orion.Engines

SELECT AddMonth(5, KeepAlive) AS ColumnResult From Orion.Engines
SELECT AddWeek(7, KeepAlive) AS ColumnResult From Orion.Engines
SELECT AddDay(17, KeepAlive) AS ColumnResult From Orion.Engines
SELECT Addhour(1, KeepAlive) AS ColumnResult From Orion.Engines
SELECT Addminute(30, KeepAlive) AS ColumnResult From Orion.Engines
SELECT AddSecond(13, KeepAlive) AS ColumnResult From Orion.Engines
SELECT AddMillisecond(1, NextPoll) AS NextPoll From Orion.Nodes

SELECT YearDiff(KeepAlive,'1/01/2020 0:0:0 AM') as ColumnResult from orion.engines

SELECT MonthDiff(KeepAlive,KeepAlive+28) as ColumnResult from orion.engines

SELECT WeekDiff(KeepAlive,KeepAlive+28) as ColumnResult from orion.engines
SELECT DayDiff(KeepAlive,KeepAlive+28) as ColumnResult from orion.engines
SELECT HourDiff(KeepAlive,KeepAlive+28) as ColumnResult from orion.engines
SELECT MinuteDiff(KeepAlive,KeepAlive+28) as ColumnResult from orion.engines
SELECT SecondDiff(KeepAlive, KeepAlive + 1) as a FROM Orion.Engines

SELECT MillisecondDiff(KeepAlive,KeepAlive+24) as ColumnResult from orion.engines

SELECT floor(ResponseTime) as ResultColumn FROM Orion.Nodes

SELECT ceiling(ResponseTime) as ResultColumn FROM Orion.Nodes

SELECT round(ResponseTime, PercentLoss) as ResultColumn FROM Orion.Nodes

SELECT ToString(101) as ResultColumn FROM SWISTable

SELECT Uri, EscapeSWISUriValue(Uri) as c FROM Orion.Engines

SELECT SplitStringToArray('Hello|§|§|world') as a FROM Orion.Engines

SELECT ToUpper ('TeStStRiNg') as CapString from Orion.Engines
SELECT ToLower ('TeStStRiNg') as LowString from Orion.Engines
SELECT Concat ('The ', 'most ','awesome ', 'string') as ConString from Orion.Engines
SELECT SubString ('123456789', 3, 6) as TestSubString from Orion.Engines
SELECT Length(ServerName) as NameLength FROM Orion.Engines
SELECT ArrayLength(MemberAncestorDetailsUrls) AS ColumnResult FROM
Orion.ContainerMembers
SELECT ArrayValueAt(MemberAncestorDetailsUrls,0) AS ColumnResult FROM
Orion.ContainerMembers
 SWQL Result

NULL, 9/25/2015 3:49:54 AM

9/25/15 8:52 AM
9/25/15 3:53 PM

9/25/15 3:55 PM

9/25/2015 8:50:37 A M
9/25/15 3:49 PM

9/1/15 12:00 AM

9/25/15 9:21 PM

2015
3
268
2
9
39
25
16
15
45
613

11/25/15 4:38 PM

9/25/20 4:25 PM
2/25/16 4:26 PM
11/13/15 4:26 PM
10/12/15 4:30 PM
9/25/15 5:31 PM
9/25/15 5:02 PM
9/25/15 4:33 PM

1
4
28
672
40320
2419200

2073600000

101
swis://Srvname./Orion/Orion.Engines/EngineID
=1, "swis://Srvname./Orion/Orion.Engines/Engi
neID=1"
[Hello, world]
TESTSTRING
teststring
The most awesome string
345678
14

/Orion/NetPerfMon/ContainerDetails.aspx?
NetObject=C:8
 Value Information
Minimum column value
Max value of column
Average of all values
Sum of all column values
Count of number of results
Absolute as in never negative

Time derived from SQL Server time zone settings

Time derived from SQL Server time zone settings
Time derived from SQL Server time zone settings

Time derived from SQL Server time zone settings

Time derived from SQL Server time zone settings
Supported values for the DatePart argument: Minute, Hour, Week, Day, DayOfYear, Month,
Quarter, Year.
Not supported: Millisecond, Second.
The second argument needs to follow the standard timezone offset +/-hh:mm .
The date in the database will have its offset changed to the specified timezone offset.
The + must be within the ' '
Year Returned only
Quarters 1-4
julian date
2= Tuesday, 4=Thursday, 6=Saturday
Shows only Month
Shows only Week Number
Shows Day of month
Shows hour
shows minutes
shows seconds
shows miliseconds
Add time to current Date
Supported values for DatePart Millisecond, Second, Minute, Hour, Week, Day, Month,
Year
5 is the number of Years
5 is the number of Months
7 is the number of Weeks
17 is the number of Days
1 is the number of hours
30 is the number of Minutes
13 is the number of seconds
1 is the number of Miliseconds
Year Difference

+28 is the number of days difference from the Keepalive Column

+28 is the number of days difference from the Keepalive Column
+28 is the number of days difference from the Keepalive Column
+28 is the number of days difference from the Keepalive Column
+28 is the number of days difference from the Keepalive Column
+28 is the number of days difference from the Keepalive Column
24 is the number of days. 24 is also the max that can used for this query

The FLOOR() rounded up any positive or negative decimal value down to the next
least integer value.
The Ceiling() will rounded up any positive or negative decimal value within the function
upwards.
The ROUND() function is used to round a numeric field to the number of decimals specified.

Works just for String properties

in case array is NULL -> it returns NULL
in case array is NULL -> it returns NULL,index starts with 0, in case index is out of range ->
query fails
Module SWIS Table
Agent Orion.AgentManagement.Agent
Core Orion.AlertStatus
Core Orion.AssetInventory.NodeWarrantyAlert
Core Orion.AuditingEvents
Core Orion.ContainerMembers
Core Orion.ContainerMembers
Core Orion.ContainerMembers
Core Orion.Events
Core Orion.EventTypes
Core Orion.Groups
Core Orion.Nodes
Core Orion.NodeVlans
Core Orion.NodeVlans
Core Orion.Volumes
DPA Orion.DPA.DatabaseInstance
IPAM IPAM.DHCPScopeOverlapping
IPAM IPAM.GroupReport
IPAM IPAM.IPConflict
IPAM IPAM.IPNodeReport
NCM Cirrus.Nodes
NPM Orion.F5.Device
NPM Orion.F5.Nodes
NPM Orion.F5.Pools
NPM Orion.F5.VirtualServers
NPM Orion.NPM.CustomPollerAssignmentOnInterface
NPM Orion.NPM.CustomPollerAssignmentOnNode
NPM Orion.NPM.CustomPollerStatusOnNodeTabular
NPM Orion.NPM.CustomPollerStatusOnNodeTabular
NPM Orion.NPM.EW.Entity
NPM Orion.NPM.FCPorts
NPM Orion.NPM.FCPorts
NPM Orion.NPM.FCRevisions
NPM Orion.NPM.FCRevisions
NPM Orion.NPM.FCSensors
NPM Orion.NPM.FCSensors
NPM Orion.NPM.FCUnits
NPM Orion.NPM.Interfaces
NPM Orion.NPM.MulticastRouting.GroupNodes
NPM Orion.NPM.MulticastRouting.Groups
NPM Orion.NPM.UCSBlades
NPM Orion.NPM.UCSChassis
NPM Orion.NPM.UCSFabrics
NPM Orion.NPM.UCSFans
NPM Orion.NPM.UCSManagers
NPM Orion.NPM.UCSPSUs
NPM Orion.NPM.VSANs
NPM Orion.Packages.Wireless.AccessPoints
NPM Orion.Packages.Wireless.Controllers
NPM Orion.Routing.Neighbors
NPM Orion.Routing.VRF
NPM Orion.WirelessHeatMap.Map
NPM / SAM Orion.HardwareHealth.HardwareCategoryStatus
NPM / SAM Orion.HardwareHealth.HardwareInfo
NPM / SAM Orion.HardwareHealth.HardwareItem
NTA Orion.Netflow.CBQoSPolicyMetric
QoE Orion.DPI.ApplicationAssignments
QoE Orion.DPI.ApplicationAssignments
QoE Orion.DPI.Applications

QOE Orion.DPI.Probes
QoE Orion.Engines
SAM Orion.APM.Application
SAM Orion.APM.Component
SAM Orion.APM.Exchange.Application
SAM Orion.APM.Exchange.Database
SAM Orion.APM.Exchange.DatabaseCopy
SAM Orion.APM.Exchange.DatabaseFile
SAM Orion.APM.Exchange.Mailbox
SAM Orion.APM.Exchange.ReplicationStatus
SAM Orion.APM.GenericApplication
SAM Orion.APM.IIS.Application
SAM Orion.APM.IIS.ApplicationPool
SAM Orion.APM.IIS.Request
SAM Orion.APM.IIS.RequestDetails
SAM Orion.APM.IIS.Site
SAM Orion.APM.IIS.SiteBinding
SAM Orion.APM.SqlDatabase
SAM Orion.APM.SqlDatabaseFile
SAM Orion.APM.SqlJobInfo
SAM Orion.APM.SqlQuery
SAM Orion.APM.SqlServerApplication
SAM Orion.APM.Wstm.Task
SRM Orion.SRM.Engines
SRM Orion.SRM.FIleServerIdentification
SRM Orion.SRM.FileServers
SRM Orion.SRM.FileShares
SRM Orion.SRM.LUNs
SRM Orion.SRM.PhysicalDisks
SRM Orion.SRM.Pools
SRM Orion.SRM.Providers
SRM Orion.SRM.StorageArrays
SRM Orion.SRM.Volumes
SRM Orion.SRM.VServers
UDT Orion.UDT.AccessPortEndpointCount
UDT Orion.UDT.DNSNameCurrent
UDT Orion.UDT.MovedMACAlert
UDT Orion.UDT.NewMACAlert
UDT Orion.UDT.NewMACVendorAlert
UDT Orion.UDT.Port
UDT Orion.UDT.RogueDNSAlert
UDT Orion.UDT.RogueEmptyDNSAlert
UDT Orion.UDT.RogueIPAlert
UDT Orion.UDT.RogueMACAlert
UDT Orion.UDT.WatchListPresent
VIM Orion.VIM.Clusters
VIM Orion.VIM.DataCenters
VIM Orion.VIM.Datastores
VIM Orion.VIM.Hosts
VIM Orion.VIM.LUNs
VIM Orion.VIM.VCenters
VIM Orion.VIM.VirtualMachines
VNQM Orion.IpSla.CCMGateways
VNQM Orion.IpSla.CCMMonitoring
VNQM Orion.IpSla.CCMPhones
VNQM Orion.IpSla.CCMRegions
VNQM Orion.IpSla.InfrastructureNodes
VNQM Orion.IpSla.Operations
VNQM Orion.IpSla.VoipCallDetails
VNQM Orion.IpSla.VoipGatewayEndpoints
VNQM Orion.IpSla.VoipGateways
WPM Orion.SEUM.Agents
WPM Orion.SEUM.Transactions
WPM Orion.SEUM.TransactionStepRequests
WPM Orion.SEUM.TransactionSteps
Name NetObjectType Prefix
Core Agents
Core Alerts
Node Warranty NWA
Auditing Events
Group Member GM
Group Member GM
Group Member GM
Core Events
Core Event Types
Group C
Node N
VLAN NVLAN
VLAN NVLAN
Volume V
Database Instance DBI
IPAM DHCPScopes Overlapping IPAM-DSO
IPAM Networks IPAMG
IPAM IPAddress Conflict IPAMN
IPAM Nodes IPAMN
NCM Nodes
F5 Devices F5
F5 Nodes FN
F5 Pools FP
F5 Virtual Servers FVS
Custom Interface Poller UNDPI
Custom Node Poller UNDPN
Custom Node Table Poller UNDPT
Custom Node Table Poller UNDPT
EnergyWise Entity EWE
Fibre Channel Port FCP
Fibre Channel Port FCP
Fibre Channel Revision FCR
Fibre Channel Revision FCR
Fibre Channel Sensor FCS
Fibre Channel Sensor FCS
Fibre Channel Unit FCU
Interface I
Multicast Routing MCGN
Multicast Routing Group MCG
UCS Blade UCSB
UCS Chassis NCH
UCS Fabric UCSF
UCS Fan UCSFAN
UCS Manager UCSM
UCS Psu UCSPSU
VSAN NVS
Wireless Access Point WLAP
Wireless Controller WLC
Routing Neighbors NBR
VRF VRF
Wireless Heatmap WLHM
Hardware Type HWHT
Hardware HWH
Hardware Sensor HWHS
NTA: CBQoS Class Map CCM
QoE Application (per node)
QoE Application (per node)
QoE Application

QoE Probes
Core Servers
APM: Application AA
APM: Component AM
AppInsight for Exchange: Application ABXA
AppInsight for Exchange: Database ABXD
AppInsight for Exchange: Database Copy ABXDC
AppInsight for Exchange: Database File ABXF
AppInsight for Exchange: Mailboxes ABXMB
AppInsight for Exchange: Replication Status ABXR
Application AA
AppInsight for IIS: Application ABIA
AppInsight for IIS: Application Pool ABIP
AppInsight for IIS: Request ABIR
AppInsight for IIS: Request Details ABIRD
AppInsight for IIS: Site ABIS
AppInsight for IIS: Site Binding ABISB
AppInsight for SQL: Database ABSD
AppInsight for SQL: Database File ABSF
AppInsight for SQL: Job Info ABSJ
AppInsight for SQL: Expensive Queries Info ABSQ
AppInsight for SQL: Application ABSA
APM: Windows Scheduled Tasks ABTT
Polling Engines
SRM File Server ID
SRM File Server
FileShare SMS
Lun SML
SRM Physical Disks
Pool SMSP
Provider SMP
StorageArray SMSA
NAS Volume SMV
VServer SMVS
AccessPort UP
UDT: Hostname UE-DNS
Moved MAC UE-MAC
New MACAddress UE-MAC
New MAC Vendor UE-MAC
UDT Port
Rogue DNSName UE-DNS
Rogue EmptyDNSName UE-IP
Rogue IPAddress UE-IP
Rogue MACAddress UE-MAC
Watch List UW
Virtual Cluster VMC
Virtual DataCenter VMD
Virtual Datastore VMS
Virtual Host VH
Virtual LUN
Virtual Center VVC
Virtual Machine VVM
VoIP Gateway VG
VoIP CallManager VCCM
VoIP Phone VCCMP
VoIP Region VR
VoIP Infrastructure P
IP SLA QoS ISOP
VoIP Call Details VCDS
VoIP PRI Trunk VVGT
VoIP PRI Gateway VVG
Location L
Transaction T
Step Request TSR
Step TS
KeyProperty column SWIS Parent Table
AgentId, AgentGuid, NodeId, PollingEngineID Orion.Nodes
AlertDefID, ActiveObject, AlertObjectID
NodeID Orion.Nodes
AuditEventID
ContainerID
MemberEntityType
MemberPrimaryID
EventID
EventType Orion.Events
ContainerID
NodeID Orion.Engines
NodeID Orion.Nodes
VlanId Orion.Nodes
VolumeID
DatabaseInstanceID
ScopeId
GroupId
IPNodeId
IPNodeId
NodeID, CoreNodeID, EngineID
ID
ID
ID
ID
CustomPollerAssignmentID
CustomPollerAssignmentID
CompressedRowID
CustomPollerAssignmentID
ID
Index
UnitID
Index
UnitID
Index
UnitID
ID
InterfaceID
MulticastGroupNodeID
MulticastGroupID
ID
ID
ID
ID
NodeID Orion.Nodes
ID
ID
ID
NodeID Orion.Nodes
NeighborID
VrfIndex
MapID
ID
ID
ID
MetricID
ApplicationID Orion.APM.Application
NodeID Orion.Nodes
ApplicationID Orion.APM.Application
Orion.AgentManagement.Agent (AgentID)
ProbeID, AgentID Orion.DPI.ProbeAssignments (ProbeID)
EngineID
ApplicationID Orion.Nodes
ComponentID Orion.APM.Application
ApplicationID Orion.APM.Application
ID
ItemID
DatabaseFileID
ID
ID
ApplicationID Orion.APM.Application
ApplicationID Orion.APM.Application
ItemID
ID
ID
ItemID
ID
ItemID
DatabaseFileID
JobInfoID
QueryID
ApplicationID Orion.APM.Application
ID
EngineID
Orion.SRM.Volumes
Orion.SRM.Volumes
FileShareID Orion.SRM.Volumes
LUNID Orion.SRM.Pools
Orion.SRM.StorageArrays
PoolID Orion.SRM.StorageArrays
ProviderID
StorageArrayID, ArrayID
VolumeID Orion.SRM.Pools
VServerID
PortID
ID
ID
ID
ID
NodeID, PortID, PortIndex Orion.Nodes
DNSNameID
IPAddressID
IPAddressID
EndpointID
WatchID
ClusterID
DataCenterID
DataStoreID Orion.VIM.LUNs
HostID, NodeID, CluserID, DatacenterID
LunID, DatastoreID,
VCenterID
VirtualMachineID, HostID, NodeID
GatewayID
NodeID Orion.Nodes
ID
RegionID
InfrastructureNodeID
OperationInstanceID
ID
VoipGatewayEndpointID
VoipGatewayID
AgentId
TransactionId
TransactionStepRequestId
TransactionStepId
Column Details
Name
AlertMessage

NetObjectType
Name

NodeCaption
Name

DisplayName

ApplicationName
ComponentName

ArrayName
Name

Name

Name

Name

Name
Status Status Name Rank
0 Unknown 495
1 Up 500
2 Down 110
3 Warning 220
4 Shutdown 496
5 Testing 480
6 Dormant 560
7 Not Present 470
8 Lower Layer Down 130
9 Unmanaged 499
10 Unplugged 498
11 External 440
12 Unreachable 150
14 Critical 210
15 Partly Available 230
16 Misconfigured 240
17 Could Not Poll 250
19 Unconfirmed 270
22 Active 540
24 Inactive 570
25 Expired 580
26 Monitoring Disabled 450
27 Disabled 460
28 Not Licensed 490
29 Other Category 1000
30 Not Running 498
Description
Has not been polled yet since being added to the system or coming out of Unmanaged status.
For IP SLA operations: when we could not contact the router to collect the results of the IP SLA operation.
Responding fine
Not responding
For Nodes - node is not responding to pings; if this continues for two minutes, node will be marked Down.
For Applications – monitored metric exceeds the warning threshold
Applies to network interfaces only
Applies to network interfaces only
Applies to network interfaces only
Applies to network interfaces only
Applies to network interfaces only
The object is unmanaged (in a maintenance window configured in Orion)
For Interfaces – you can set an interface to be “unpluggable”. In this case it will either be Up or Unplugged instead of the usual
For Nodes – you can configure a node as “external”. In this case Orion does not ping the node for Up/Down status, but you can
Object status cannot be determined because it is dependent on another node that is currently down. See the doc.
Nodes - Monitored Metric exceedes Critical threshold.
For Applications – monitored metric exceeds the Critical threshold
Not used for individual objects.

SAM: For Applications – there are more component monitors assigned than there are licenses available.
Never to be placed on an object. CategoryStatusMap allows joining back to StatusInfo to place statues into one of several buck
This status value is the result of a status that is not "relevant" from an "issue" perspective and deserves to be in the "other" bu
For SAM processes and IIS Application Pools that are not running. This status is not issue (it is expected state) so it is ignored in