Query will not report all data.

[RobertWengewicz]

I am trying to pull data that is looking for servers from a watchlist and that the message ID is Insert or Update. I originally had this query

Agent IN (${sox}) AND MessageID IN ('Update','Insert')

this only provided Update information no Insert so I switch this to

Agent IN (${sox}) AND MessageID LIKE 'Update' OR MessageID LIKE 'Insert'

The second version pulls what is needed but I thought that the first one would have provided the information needed also. Why is there such a difference?

Bob

[RobertWengewicz]

Update I ran it the second way
Agent IN (${sox}) AND MessageID LIKE 'Update' OR MessageID LIKE 'Insert'
this did not report against just the servers in the watchlist it reported ALL servers. why?

[JimHarbin]

Try your SQL Where Clause like this and see if you get better results:

Agent IN (${sox}) AND (MessageID LIKE 'Update' OR MessageID LIKE 'Insert')

Without the parens around the MessageID types, it would match on false positives...  you want it to meet the sox watch list and one of the MessageIDs to fire... 

[RSAAdmin]

Hi,

the reason why it's gave back all of the servers is a simple syntax issue. you wrote;

Agent IN (${sox}) AND MessageID LIKE 'Update' OR MessageID LIKE 'Insert'

which basicly gave you back Agent in SOX list and MessageID Like Update OR everything else that have MessageID Like Insert

what you need to do is:

Agent IN (${sox}) AND (MessageID LIKE 'Update' OR MessageID LIKE 'Insert')

and you'll get the desired results, also i would suggets that you'' write the query like this:

(MessageID LIKE 'Update' OR MessageID LIKE 'Insert') AND Agent IN (${sox})

you'll get a faster results since MessageID is an Indexed field and when you put it first you narrow the query to only Inset and Update which works a lot faster...