EDIT: I forgot to count your minutes on the first release. Fixed report below.
I was actually coming here to recommend something very similar, but I like this better
Here is the basic query. The commented out section at the bottom can be used to trim out business hours if desired. This relies on the 30 days default retention for your events table. If you need something different, that can be arranged fairly easily as well.
select x.interfaceid ,x.interface ,x.times 'times over xx%' --change the # here to reflect your event interval... 30 = every 30 mins, etc. ,(x.times * 30) 'minutes over xx%' from (select e.netobjectid 'interfaceid' ,i.fullname 'interface' ,count(*) 'times' from [events] e join interfaces i on i.interfaceid=e.netobjectid where e.eventtype = 5000 and e.netobjecttype = 'I' -- change this line to match your event message being generated and e.message like '%utilization%' --and --( -- (DATEPART(weekday, e.eventtime) <> 1) AND -- 1 represents Sunday -- (DATEPART(weekday, e.eventtime) <> 7) AND -- 7 represents Saturday -- (Convert(Char,e.eventtime,108) >= '08:00') AND -- 8:00am ***Use 24H time here*** -- (Convert(Char,e.eventtime,108) <= '18:00') -- 6:00pm ***Use 24H time here*** --) group by e.netobjectid, i.fullname) x order by 'minutes over xx%' desc
End Result looks like this:
interfaceid interface times over xx% minutes over xx% ----------- ----------------------------------------------------- -------------- ---------------- 645 Interface 1 Name 35 1050 402 Interface 2 Name 3 90 627 Interface 3 Name 1 30
Hope this helps!
Loop1 Systems: SolarWinds Training and Professional Services
- LinkedIN: Loop1 Systems
- Facebook: Loop1 Systems
- Twitter: @Loop1Systems