When I run the following SWQL, it returns about 25 events.
select N.Caption, N.MachineType, E.Message, E.EventTime
from Orion.Nodes N
join Orion.Events E on E.NetObjectID = N.NodeID
where N.Status = '2'
order by E.EventTime desc
I wanted to try limiting the result to 5 events, like so:
select top 5 N.Caption, N.MachineType, E.Message, E.EventTime
from Orion.Nodes N
join Orion.Events E on E.NetObjectID = N.NodeID
where N.Status = '2'
order by E.EventTime desc
This works, except that it seems to execute the "select top 5" before the "order by E.EventTime". So the result ends up being the first five (oldest) events found vs the the most recent events. Any idea what is going on here? If I run this in SQL, it behaves as expected, but in SWQL, it has this different behavior.