Hi all Running into a `constraint failed` error when queryin

Question

Hi all Running into a `constraint failed` error when querying the `windows eventlog` table from fleet After some troubleshooting I found that `channel` is a required constraint in the WHERE clause which I have added but still get the same `constraint failed` error is there another required constraint when querying `windows eventlog` Any help is greatly appreciated

Kathy Satterlee · Answer

Hi < zhong> Can you share the query in question

zhong · Answer

```SELECT datetime computer name json extract windows eventlog data $ EventData ParentProcessName as Parent from windows eventlog where eventid = 4688 and channel = Security and json extract windows eventlog data $ EventData ParentProcessName like winword exe and json extract windows eventlog data $ EventData NewProcessName = C Windows System32 wbem WMIC exe or json extract windows eventlog data $ EventData NewProcessName like excel exe or json extract windows eventlog data $ EventData NewProcessName like outlook exe ```

Kathy Satterlee · Answer

Try source rather than channel

zhong · Answer

Returned `no such column source`

Kathy Satterlee · Answer

I may have checked the wrong table one sec

Kathy Satterlee · Answer

Reaching out for a hand bear with me

Kathy Satterlee · Answer

Try removing the quotes around `eventid` It could be that it isn t getting parsed properly as an integer

zhong · Answer

still got `constraint failed` sweat

Kathy Satterlee · Answer

Does a simpler query without the json extraction work

Kathy Satterlee · Answer

```SELECT datetime computer name from windows eventlog where eventid = 4688 and channel = Security ```

zhong · Answer

yes just tried running this query ```SELECT datetime computer name json extract windows eventlog data $ EventData ParentProcessName as Parent from windows eventlog where eventid = 4688 and channel = Security ``` and was able to get results

Kathy Satterlee · Answer

Brilliant You can go from there to start layering the additional clauses on and see what happens

zhong · Answer

Thank you

Kathy Satterlee · Answer

< zhong> Did you get this sorted I d love to know what the culprit was

zhong · Answer

yes error came down to syntax using `or` resets the constraints set before so in the end i had it working with ```SELECT datetime computer name json extract windows eventlog data $ EventData ParentProcessName as Parent from windows eventlog where eventid = 4688 and channel = Security and json extract windows eventlog data $ EventData ParentProcessName like winword exe and json extract windows eventlog data $ EventData NewProcessName = C Windows System32 wbem WMIC exe or json extract windows eventlog data $ EventData NewProcessName like excel exe or json extract windows eventlog data $ EventData NewProcessName like outlook exe ``` the parenthesis ensures that it keeps the previous constraints

Kathy Satterlee · Answer

Nicely done SQL can be a bear