Filtered Events as Widget on Dashboard

Dal

Is it possible?

Like this:

Only way to see this now, is to actually click into the Events view, and then filter it.

But we would like to see information like this directly on the frontpage dashboard

Thanks

Find more posts tagged with

Accepted answers

All comments

stuartd

You could absolutely do this as a modern dashboard. What I don't know is if you can set a Modern Dash as a homepage. I know it was (is still?) a feature request but unsure if it has been implemented.

You could also do this as a Custom Query widget. You'd need to code the SWQL to suit what you want, but we do a similar thing on the node details template and the custom query extracts the last 100 Events that affected that node [identified by the ${NodeID} section].

Code for that is:

--------------------------------
-- Last 100 Events for a Node --
--------------------------------
SELECT TOP 100 [Events].EventTime AS [Time of Event]
     , [Events].EventTypeProperties.Name AS [Event]
     , [Events].Message AS [Message]
     , CONCAT('/NetPerfMon/images/Event-', TOSTRING([Events].EventType), '.gif') AS [_IconFor_Message]
FROM Orion.Events AS [Events]
WHERE [Events].Nodes.NodeID = ${NodeID}
AND Message NOT LIKE 'Bad trap packet%'
ORDER BY [Events].EventTime DESC

Dal

Thanks for answering.

It seems the Custom Query will need some tweaking as it fails just by pasting it in

But how do I acheive this by set up a Modern Dashboard?

Thanks again

stuartd

The code may fail because it references aspects only in our environment. I provided it as an example of what might be achievable.

For a Modern Dashboard it is a similar approach. You would add a blank widget to your dashboard of choice and then click on 'Finish Configuring' This will give you a list of pre-defined widgets along with any you might have already created.

Probably easiest if the first time to click on Source Dashboard and set the dropdown to 'Empty Widgets'. On the presumption you want to create a table then select 'Table Widget' and then Customise and edit to suit. If like me you hit 'Create Widget' don't worry, just re-select the newly created widget block and again, edit to suit. You could try the Graphical Query Builder but I've always had better success with the 'Hand edit a SWQL Query'.

Plenty of stuff in THWACK already about creating and using MD's if you haven't yet. And if that's the case, might be best to start here: 93. A Step-By-Step Guide to Building Modern Dashboards

cscoengineer

The eventtype of SAM Monitor Down is 507. So it soule be faily simple to filter on the events table.

SELECT
tostring(tolocal(e.EventTime)) as [Time]
,e.Message as [Message]
,concat('/NetPerfMon/images/Event-',e.EventType,'.gif') as [_IconFor_Message]
from Orion.Events e
where daydiff(tolocal(e.eventtime),getdate()) = 0
and e.EventType=507
order by tolocal(e.EventTime) desc

Dal

Thanks to both of you for your answers.

I understand thing a bit better now.

I couldn't understand the syntaxes at first until I realized it was built using SWQL, not regular MS SQL

It seem we can create our own columns in here as well.
Do you know it it's possible to use regex to filter CASE further ?

Thanks again