Average Load Per CPU

This is sort of dove-tails with the question here: Alerts of individual CPUs in a Node but I wanted to put something fresh out with some more detail. I've put together a custom SWQL alert trigger that will respond to the latest sample of any individual CPU on a node exceeding the threshold in the where clause:

SELECT Nodes.NodeID, CPU.CPUIndex, CPU.AvgLoad
FROM Orion.Nodes AS Nodes
JOIN Orion.CPUMultiLoad CPU ON Nodes.NodeID = CPU.NodeID
JOIN
(   SELECT NodeID, MAX(TimeStampUTC) AS MaxTimeStampUTC   FROM Orion.CPUMultiLoad   GROUP BY NodeID
) TBL1 ON CPU.TimeStampUTC = TBL1.MaxTimeStampUTC AND CPU.NodeID = TBL1.NodeID
WHERE Nodes.NodeID = 46

-- Result:
-- 46,0,0
-- 46,1,0
-- 46,2,11
-- 46,3,11
-- 46,4,29
-- 46,5,29
-- 46,6,52
-- 46,7,52
-- 46,8,0
-- 46,9,0
-- 46,10,29
-- 46,11,29
-- 46,12,11
-- 46,13,11
-- 46,14,64
-- 47,15,64

That seems to work fine, but when I write some SQL to use in the alert action message using the same CPUMultiLoad view from the database I get only CPU 0:

SELECT CPU.CPUIndex, CPU.AvgLoad
FROM CPUMultiLoad AS CPU
JOIN
(    SELECT NodeID, CPUIndex, MAX(TimeStampUTC) AS MaxTimeStampUTC    FROM CPUMultiLoad    GROUP BY NodeID, CPUIndex
) TBL1 ON CPU.TimeStampUTC = TBL1.MaxTimeStampUTC AND CPU.NodeID = TBL1.NodeID
WHERE CPU.NodeID = 46

-- Result: 0, 9

Any thoughts on why the SWQL would be happy but the SQL wouldn't? Am I beating around the wrong bush?

Thanks in advance,

--

Steven W. Klassen

Programmer Analyst @ Loop1 Systems

http://www.loop1systems.com/

http://www.linkedin.com/in/mrxinu