I have a .sql script that works great for eliminating duplicate returned rows, except that there are some fields where the Message has a counter value in it like this:
The VMware VirtualCenter Agent service terminated unexpectedly. It has done this 328 time(s). ...
The VMware VirtualCenter Agent service terminated unexpectedly. It has done this 327 time(s). ...
So as you can see, it sees each as being unique. I would like to just take the first 35 or so characters of that field and use it to determine if it is a duplicate or not, along with the other fields that are there.
Here is the script:
=============== ===============
SELECT
ComputerName,
EventType As Err#,
SourceName AS Name,
EventId,
count(*) AS Times,
message
INTO %FileOut%
FROM \\%SRVname%\sys tem
WHERE SUB (to_int(TimeGen erated), to_int(System_T imeStamp())) > -86400
AND sourcename not in
('Print' ;
'MRxSmb' ;
'w32time' ;
'TermServDevice s') AND
EventType <= 2
GROUP BY ComputerName,Er r#,EventID,Name ,Message
HAVING Times >= 1
ORDER BY Times desc
=============== =============== ========
Any ideas on how to do this?
The VMware VirtualCenter Agent service terminated unexpectedly. It has done this 328 time(s). ...
The VMware VirtualCenter Agent service terminated unexpectedly. It has done this 327 time(s). ...
So as you can see, it sees each as being unique. I would like to just take the first 35 or so characters of that field and use it to determine if it is a duplicate or not, along with the other fields that are there.
Here is the script:
=============== ===============
SELECT
ComputerName,
EventType As Err#,
SourceName AS Name,
EventId,
count(*) AS Times,
message
INTO %FileOut%
FROM \\%SRVname%\sys tem
WHERE SUB (to_int(TimeGen erated), to_int(System_T imeStamp())) > -86400
AND sourcename not in
('Print' ;
'MRxSmb' ;
'w32time' ;
'TermServDevice s') AND
EventType <= 2
GROUP BY ComputerName,Er r#,EventID,Name ,Message
HAVING Times >= 1
ORDER BY Times desc
=============== =============== ========
Any ideas on how to do this?