So in this example, I'm trying to return NULL instead of the empty nvarchar for element2 and element3. It seems that I can not find the answer to this anywhere, or if it is possible. I know that I can check .exists () with nullif of Case / When, but I would prefer not to do this check for performance.
WqlEventQuery query = new WqlEventQuery ();
query.EventClassName = "__InstanceCreationEvent";
query.Condition = "TargetInstance ISA 'Win32_NTLogEvent'";
query.GroupWithinInterval = new TimeSpan (0, 0, 10);
System.Collections.Specialized.StringCollection collection =
new System.Collections.Specialized.StringCollection ();
collection.Add ("TargetInstance.SourceName");
query.GroupByPropertyList = collection;
query.HavingCondition = "NumberOfEvents> 25";
source share