So in this example I m trying to return a NULL instead of an empty nvarchar for element2 and element3. I can t seem to find an answer to this anywhere, or if it s even possible. I know I can check .exists() with a nullif of Case/When, but I d rather not make that check for the sake of performance.
WqlEventQuery query = new WqlEventQuery(); query.EventClassName = "__InstanceCreationEvent"; query.Condition = "TargetInstance ISA Win32_NTLogEvent "; query.GroupWithinInterval = new TimeSpan(0, 0, 10); System.Collections.Specialized.StringCollection collection = new System.Collections.Specialized.StringCollection(); collection.Add("TargetInstance.SourceName"); query.GroupByPropertyList = collection; query.HavingCondition = "NumberOfEvents > 25";