So in this example I'm trying to return a NULL instead of an empty nvarchar for element2 and element3. I can't seem to find an answer to this anywhere, or if it's even possible. I know I can check .exists() with a nullif of Case/When, but I'd rather not make that check for the sake of performance.
WqlEventQuery query = new WqlEventQuery(); query.EventClassName = "__InstanceCreationEvent"; query.Condition = "TargetInstance ISA 'Win32_NTLogEvent'"; query.GroupWithinInterval = new TimeSpan(0, 0, 10); System.Collections.Specialized.StringCollection collection = new System.Collections.Specialized.StringCollection(); collection.Add("TargetInstance.SourceName"); query.GroupByPropertyList = collection; query.HavingCondition = "NumberOfEvents > 25";