SWQL (SolarWinds Query Language)

Last updated: 2026-05-24

SWQL is SolarWinds' SQL-like query language for the Orion data model. It is what the SWIS API accepts and what powers every custom report, alert trigger, and integration.

What it is

SolarWinds Query Language (SWQL) is a SQL-like query language for the SolarWinds Orion data model. It's what the SWIS API accepts. Any custom report in Orion, any alert trigger condition, any third-party integration that reads Orion data, every screen in PocketNOC — they're all built on SWQL queries under the hood.

SWQL syntax looks very close to standard SQL with a few extensions for the entity-relationship model Orion uses. Example:

SELECT Caption, Status, IPAddress, ResponseTime
FROM Orion.Nodes
WHERE Status = 2
  AND ResponseTime > 100
ORDER BY ResponseTime DESC

That's "show me all critical nodes with response time over 100ms, slowest first." If you've written SQL, you can write SWQL inside 30 minutes.

Differences from standard SQL

• Navigation properties — instead of joining tables manually, SWQL exposes named relationships. SELECT Node.Caption FROM Orion.NPM.Interfaces follows the Interface → Node relationship automatically.
• Entity types are namespaced — Orion.Nodes, Orion.NPM.Interfaces, Orion.SAM.Applications, Orion.NetFlow.Flows. The namespace tells you which module owns the data.
• No data modification — SWQL is read-only. Writes go through SWIS POST / PUT / DELETE verbs with structured payloads, not SQL.
• Custom functions — SolarWinds adds Orion-specific functions like ToLocal(), HoursDiff(), etc.

Where to write SWQL

• The Orion Web Console has a SWQL Studio under Settings → Manage Reports for ad-hoc queries.
• The standalone SWQL Studio desktop tool ships with the Orion SDK.
• Any HTTP client that can POST to the SWIS endpoint — curl, Postman, custom scripts.
• Inside Orion Reports and Alerts as the query that drives them.

SWQL in PocketNOC

PocketNOC's queries are baked into the app at build time — there is no user-facing SWQL editor in the mobile UI. Each screen maps to one or more SWQL queries that pull just the data the screen needs.

See also

• SWIS API — the endpoint SWQL queries are POSTed to.
• Orion Platform — the data model SWQL queries.
• SolarWinds SWQL docs (external).