So in this example I'm trying to return a NULL instead of an empty nvarchar for element2 and element3. I can't seem to find an answer to this anywhere, or if it's even possible. I know I can check .exists() with a nullif of Case/When, but I'd rather not make that check for the sake of performance.
WqlEventQuery query = new WqlEventQuery();
query.EventClassName = "__InstanceCreationEvent";
query.Condition = "TargetInstance ISA 'Win32_NTLogEvent'";
query.GroupWithinInterval = new TimeSpan(0, 0, 10);
System.Collections.Specialized.StringCollection collection =
new System.Collections.Specialized.StringCollection();
collection.Add("TargetInstance.SourceName");
query.GroupByPropertyList = collection;
query.HavingCondition = "NumberOfEvents > 25";
See Question&Answers more detail:
os 与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…