Modern Dashboard SWQL WPM Transactions

I have an SWQL for my alerting on WPM Transactions. I'm trying to get the Alert Object that is causing the alert and can't figure it out. If anyone can improve the SWQL WPM Transaction alert I would appreciate any input. Thank you!

SELECT E0.[DisplayName], E0.[LastDateTimeUtc]
FROM Orion.SEUM.Transactions AS E0
WHERE ( ( E0.[Status] = '3'*1 ) OR ( E0.[Status] = '14'*1 ) OR ( ( E0.[Status] = '2'*1 ) ) OR ( ( E0.[Agent].[Engine].[Probe].[Agent].[Node].[CustomProperties].[Environment] = 'MDI - Prod' ) ) )

Find more posts tagged with

Alert

query

sql

solarwinds

wpm

Accepted answers

All comments

antonis.athanasiou

What's the alert triggering on, a transaction or a single step? the query will be different as the alert is targeting different Orion entities. Also, are you trying to display active alerts and the object that triggered the alert in a dashboard ?

a few more details on what you're trying to achieve will make it easier to help you!

Jason.Becker

Hi Antonis, right now the alert is triggered on the status and time of alert, If critical trigger an alert. I'm trying to display the active alerts and the WPM object that triggered that alert.

antonis.athanasiou

not sure whether the alert is triggered when a transaction or a step is critical but the query below should work for both. Depending on the object, there's more information to display but it will look messy if one tries to join/union the results for both transaction and steps:

SELECT ActiveObject, ObjectType, State,  ObjectName, AlertMessage, TriggerTimeStamp,  TriggerCount,  Acknowledged, AcknowledgedBy, AcknowledgedTime,  AlertNotes,  AlertObjectID, NetworkNode, NetObjectID, NetObjectType
FROM Orion.AlertStatus
WHERE NetObjectType IN ('T','TS')

More info can be obtained, let me know if this helps

adam.beedell

There's a couple potential ways to interpret what you're asking for that have different answers

"I want to add the object to this query" - Seems like you've got it on Displayname, could add e0.transactionID I guess

"I want to get the alertobject property from one of the alert tables" could Join Orion.AlertActive aa on aa.alertobjectID = e0.transactionID. You are kinda starting with an ID though so the question feels weird, more like-

"Can I get the rest of the alert stuff for one of these objects?" - See above

"I want a filtered alert dash for WPM stuff" - Start at AlertActive, join AlertObjects where ao.EntityType like 'Orion.SEUM%'. Maybe start from someone else'sthe work there's a few good alerts views shared on here already. Not sure that entity type is right, the env I'm in right now doesnt have any WPM alerts active

Maybe something else?

Jason.Becker

Hi Antonis, that's perfect Thank you! How would I be able to add the link to the alert on this query?