0 Replies Latest reply: Oct 8, 2013 4:29 PM by hilbertd21 RSS

EOC SWQL filter for 'Global Last XX Active Alerts'

hilbertd21

1.) In EOC, I want to show only those nodes that are Domain Controllers that have active alerts under the 'Global Last XX Active Alerts' resource.

2.) I've used the following syntax with Global Nodes Down resources to filter these, and works fine: Node.CustomProperty.DeviceFunction like '%Domain Controller%'

3.) However, does not work on 'Global Last XX Active Alerts'

 

So, knowing you have to first select the SWQL Resource Matrix alias, I double check and verify the first portion in the statement.

 

EOC resource matrix for Alert SWQL alias.PNG

 

So, my logic is, I add in the actual custom property 'DeviceFunction' to Node.CustomProperty, and I get Node.CustomProperty.DeviceFunction, which should allow me to use either 'like' or '=' to associate with any value I have nested under 'DeviceFunction' in Orion. Which 'Domain Controller' is one of them.

 

Then, checking Built-in properties by Data Type, which is what you would normally include as the 2nd half of the query, separated by a period, for say just 'Node.' query building, correct?

I see the following options, which I never used in my above query that DOES work for say, 'Global Nodes Down' resource.

 

EOC resource matrix for Built-in Properties by Data Type node.PNG

I know it's right in front of me, but I've been trial and error testing with the same error on top resource not working, but does work on bottom one (and for a few others as well for that matter).

 

EOC resource matrix for Alert fail but node down works same query.PNG