SWQL for short lived alerts

aycode

Is there a way to detect short lived alerts, e.g. alerts that are triggered, then perhaps, 10 seconds or 1 or 2 minuutes later, they are no longer triggered? e.g. if a Node has an intermittent fault that causes and alert to be triggered constantly but the alert is only active for a few minutes.

bobmarley

Here is a SWQL Query I found on Thwack. It shows all the ones that fired and how frequently

SELECT --TOP 25 
  COUNT( AlertHistoryID ) AS [Alert Count]
, oah.AlertObjects.AlertConfigurations.DisplayName AS [Alert Name]
, oah.AlertObjects.RelatedNodeCaption AS [Node Name]
, oah.AlertObjects.EntityCaption AS [Alert Entity Name]
, oah.AlertObjects.EntityType AS [Alert Classification]
, oah.AlertObjects.AlertConfigurations.Frequency AS [Alert Evaluation Frequency (seconds)]
, CASE --check if alert trigger condition contains setting for 'Condition Must Exist For'
    WHEN oah.AlertObjects.AlertConfigurations.Trigger LIKE '%%' THEN 'No'
    ELSE 'Yes' 
    END AS [Condition Must Exist For Delay]
, CASE --check if alert trigger condition contains setting for 'Condition Must Exist For'
    WHEN oah.AlertObjects.AlertConfigurations.Trigger LIKE '%%' THEN ''
    ELSE REPLACE(SUBSTRING( 
            --substring s
            oah.AlertObjects.AlertConfigurations.Trigger, 
            --substring start
            (CHARINDEX(
                'P', 
                oah.AlertObjects.AlertConfigurations.Trigger, 
                0)+14),
            --substring length
            (CHARINDEX(
                '', 
                oah.AlertObjects.AlertConfigurations.Trigger, 
                0) - CHARINDEX(
                        'P', 
                        oah.AlertObjects.AlertConfigurations.Trigger, 
                        0) - 14)
            ), --end substring
        --replace pattern
        'T',
        --replace replacement
        ''
        ) --end replace
        END AS [Delay Setting]
FROM Orion.AlertHistory oah
--WHERE EventType = 0 --https://support.solarwinds.com/SuccessCenter/s/article/Meaning-of-EventTypes-value-in-the-AlertHistory-table?language=en_US
Where [OAH].TimeStamp >= GETUTCDATE() - 14
GROUP BY oah.AlertObjects.RelatedNodeCaption, oah.AlertObjects.AlertConfigurations.DisplayName, oah.AlertObjects.EntityCaption, oah.AlertObjects.RelatedNodeCaption, oah.AlertObjects.EntityType, oah.AlertObjects.AlertConfigurations.Frequency
ORDER BY [Alert Count] DESC