I'm working with EOC trying to use the Custom SWQL query resources to get a resource to show me all Acknowledged alerts from Orion servers. The following works in SQL:
Select
EOC_AlertStatus.ObjectName, EOC_AlertStatus.TriggerTimeStamp,
EOC_AlertDefinition.Name, EOC_AlertStatus.Acknowledged,
EOC_AlertStatus.AcknowledgedTime, EOC_AlertStatus.AcknowledgedBy
From EOC_AlertStatus
Join EOC_AlertDefinition on EOC_AlertStatus.AlertDefID = EOC_AlertDefinition.AlertDefID
Where EOC_AlertStatus.Acknowledged = 1
But if I try to use it following the SWQL documentation I've found, trying to run it this way:
SELECT
EOC.AlertStatus.ObjectName, EOC.AlertStatus.TriggerTimeStamp,
EOC.AlertDefinition.Name, EOC.AlertStatus.Acknowledged,
EOC.AlertStatus.AcknowledgedTime, EOC.AlertStatus.AcknowledgedBy
FROM EOC.AlertStatus
INNER JOIN EOC.AlertDefinition on EOC.AlertStatus.AlertDefID = EOC.AlertDefinition.AlertDefID
WHERE EOC.AlertStatus.Acknowledged = 1
results in the resource being unable to process the request. Anyone thoughts?