Shared Files for the Orion Platform
  • Alerts Event Type Actions Report

    Hello THWACK Community, The SWQL Custom Query Alerts Event Type Actions Report, has been primarily written to show a list of ‘Failed’ Alert Events Type Actions, at the top with all of the other Alerts Event Type Actions listed below in a custom order. The SWQL Custom Query Alerts Event Type Actions Report, is to used to ideally identify and help troubleshoot the HEALTH: Failing Alerts Actions, that are shown in summary within the Orion Insight Report of the SolarWinds Platform. As follow up...
  • NTA: Number of flows per Device/per Interface

    Below widgets are counting number of flows per device and per interface. By default, flows are counted per hour (last 4 hours). Each hour is defined by down sampling to '01:00:00' and it can be easily modified within the query, i.e. '00:15:00' if 15 minutes intervals are required. Additionally, below where statement provides full hours. Downsample(TOLOCAL(Timestamp),'01:00:00') >= AddDate('hour', -4, GETDATE()) If a current time is 18:33, then flows are counted as follows (4 full hours...
  • Widget: VMAN ESX Host Alarms From vCenter

    This query was built to show active alarms in vCenter. Our specific need was to know when one of the NIC's on the virtual host went down. The alarm shows in vCenter and the status of the ESX Host changes in SolarWinds, but it was not clear why the host status changed in SolarWinds. This widget is added to the 'ESX Host Details' page and will filter active alarms by the host/node you're viewing.
  • Multi-Statistic Data (Script Components) and pivot example

    I don't have to do it often, but when I do I can never remember how to "PIVOT" data between elements in the SolarWinds API. I decided to write something up and share it as a custom query. This particular example uses statistic and message data returned from SAM Script Templates. It doesn't matter if the sources are SAM templates or Universal Device Poller results - this same PIVOT logic should work. Please note that this isn't a simple copy/paste. You'll need to look at the connected data points...
  • ICMP Status Only vs. Paid Nodes for HCO Details | Older than v2022.3

    Hello and salutations, Thank you for your consideration of our Hybrid Cloud Observability (HCO) product which is built on the SolarWinds Platform (formerly known as Orion). This new license model provides at lot of advantages over the heritage point products, and we group the various functionality of the various point products into a new product offering. Therefore, this document is to help determine the license tier you will be in by converting over your existing products into the new HCO offering...
  • Daily Platform Maintenance

    I don't remember where I got this, but this is a custom query widget reporting the start time, end time, and duration of the daily maintenance on your SolarWinds Platform. As configured it pulls events for the last 7 days, but can be configured for longer times by adjusting the - 7 in line 44 to whatever duration you'd like. Be sure to change the Number of Rows per page setting in the Custom Query widget if you don't want pagination.
  • Group Membership (Node)

    This is something I threw together to enumerate the groups (both traditional and maps) where a Node is used. It's designed to be placed on a Node Details page and will not function correctly on other pages (like summary pages, interface details pages, volume details pages, application detail pages etc.). Recommended query title and subtitle are also listed in the SWQL. It is search capable, and instructions are outlined in the query itself.
  • Unmanaged Nodes with custom names

    This displays the name of the node, when the unmanage action begins, when it ends, the time the unmanage action was completed, and the name of the person in human readable form. You will need to acquire a list of Solarwinds users first. The code for that is at the bottom of the query Solarwinds doesn't have extra tables in the database to allow human readable names to accounts so unmanage actions are shown as Active Directory accounts. In our organization these read like this DomainName\user2868732...
  • Widget: Node Status Root Cause

    I built a query to better show by a particular node is in warning/critical status. I know you can hover over areas to get that detail but I wanted to have it all in one place. Not all entries have a URI but the ones that do are hyperlinked in the query. Navigate to the Node Details page where you want to add this widget Click on the pencil icon on the top-left Click on 'Add Widget' button on the top-right Search for 'query' Drag the 'Custom Query' resource onto the page Click on the...
  • Widget: NetFlow Usage Per Polling Engine Query

    This query will allow you to see the flows per second (NetFlow) that you are receiving per Polling Engine. You can add a widget to any dashboard page by: Navigate to the dashboard where you want to add this widget Click on the pencil icon on the top-left Click on 'Add Widget' button on the top-right Search for 'query' Drag the 'Custom Query' resource onto the page Click on the 'Done Adding Widgets' button Click on the 'Done Editing' button Find the new widget on the page and click...
  • Widget: Node Status vs. Node Polling Method Widget (Node Details)

    I had a need to know how the node status was being calculated vs how the node was being polled. I added a 'Custom Query' widget to my 'Node Details' page and used the following attached query. I also created this as a report to list all nodes with the status vs polling method. You can see those details here .
  • Map Membership (Nodes)

    Follow-up on a report for Nodes Map Membership. This is a query that can be put on any summary page with (optional) filter. (Described in the SWQL) As Built Search Results (for 'switch') Original Request: Report or Widget to Identify any nodes not included in any map - Orion SDK - The Orion Platform - THWACK ( Related Report: Map Summary Report (Nodes) - Reports - The Orion Platform - THWACK (
  • Classic Dashboard Widget List (and Search)

    Someone recently asked if there was a way to determine the widget type behind a resource. There it, and it's accessible via the API. This is a searchable listing of all widgets on your system. It searches the Dashboard Name, the Parent Name (if a NOC-style dashboard), the position on the page (column, and position), the Widget Type, the Widget Name (as displayed on the dashboard) and the Widget Subtitle (as displayed on the dashboard). In the event that it returns either a NOC or a Summary...
  • Maps containing Node (Node Details)

    In helping out another THWACK user on this thread , I decided that this might be useful for others, so here it is... This is meant to be placed on a Node Details Page and configured like this: The query is very simple and I decided to just have it sort by name. Nothing more onerous. Note: This is meant to be on a Node Details page and won't work properly elsewhere.
  • NCM Backup Job Config Status

    This query is an attempt to pull together as much information within NCM as far as its backup jobs go, NCM login status and the age of the last backup. It's not perfect and relies on a few not so ideal ways to join various bits of data but it's sufficient. Long story short, SolarWinds NCM could do a better job at auditing its own happenings. Regardless, here's what the query shows and also a mockup of what it looks like if you use within a modern dashboard. Last Login status, "Login OK" = 1...
  • Access Layer VLANs (with good/bad VLAN defined)

    This provides a list of all interfaces with an assigned Access-level VLAN (trunks ignored). Includes icons for vendor, interface type, and a faux-status on a matching VLAN ID (as defined in the query). Mostly this was created so that I could validate that you can stitch together VLAN --> Interface --> Node correctly, but I figured I would share it. Summary Page (query as is) Node Details Page (requires minor edits, see below ) Possible Use Cases Could be used to identify ports on specific...
  • Query date template assigned node SAM (SQL)

    Note this is a SQL query (not SWQL). Query date template assigned node SAM SET NOCOUNT OFF SET ROWCOUNT 0 DECLARE @StartDate DateTime DECLARE @EndDate DateTime DECLARE @Rango DateTime DECLARE @ResultVar real SET @StartDate = DATEADD(DD,-30,DATEADD(DD,DATEDIFF(DD,0,GETDATE()),0)) SET @EndDate = DATEADD(DD,0,DATEADD(DD,DATEDIFF(DD,0,GETDATE()),0)) SELECT ,n.caption ,a.created ,a.lastModified FROM APM_Application A INNER JOIN Nodes N ON a.nodeid = n.nodeid WHERE a.Created >= @StartDate...
  • Run a query about licensed component monitors in SAM

    The query is from the below site but re-written to work in SWQL Studio or a custom query Run a report about licensed component monitors in SAM ( Hope its useful, I also adjust the case part and just show the column data as I want to found out the actual total not that its 50 for AppInsight, etc. replace - CASE WHEN r . Template = 'Windows Scheduled Tasks' THEN 5 WHEN r . Template LIKE 'AppInsight for IIS' THEN 30 WHEN r . Template LIKE 'AppInsight for%' THEN 50 ELSE COUNT...
  • Query last 7 days of alert email action history in SWQL

    Quick query to pull the last 7 days of alert email action history via SWQL. SELECT ac.Name AS [Alert Configuration] ,ah.Message AS [Action Message] ,ah.AlertObjects.EntityNetObjectId ,ah.EventType ,ah.TimeStamp ,ah.ActionID ,a.ActionTypeID AS [ActionType] ,a.Title AS [ActionName] ,n.NodeName AS [Node] FROM Orion.AlertHistory AS ah INNER JOIN Orion.Nodes AS n ON CONCAT('N:', TOSTRING(n.NodeID)) = ah.AlertObjects.EntityNetObjectId LEFT JOIN Orion.Actions AS a ON a.ActionID ...