Remove the default query when building SWQL advance alert?

Cheesecrisp89

I am building a query for an alert. Is there a way to remove the auto populated query statements when using "Custom SWQL Alert (Advanced) feature? For instance,  SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes autopopulates and I would like a blank slate, thanks!

ronan.tonilon

Disclaimer:
The content posted herein are provided as a suggestion or recommendation to you for your internal use. The information set forth herein may come from third party website or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.
Please try this first in a lab environment, before implementing to your production.

You can open a support ticket to get insights, but please take note of our Working with Support Policy, customizations are not supported especially if this would involved custom scripts or queries, support can assist in a best effort practice since our support team is intended as a break fix support.

Unfortunately, the Custom SWQL Alert (Advanced) editor in SolarWinds does not support completely removing the auto-populated query (i.e., SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes). This is because SolarWinds inherently requires the Uri and DisplayName fields from the primary entity (Nodes, Interfaces, Volumes, etc.) to uniquely identify and reference the objects involved in the alerting framework.

Workaround that can be tried:

1. Modify the existing base statement
   You can modify the auto-populated query as needed, provided you keep the two required fields (Uri and DisplayName) in your query.

   SELECT Nodes.Uri, Nodes.DisplayName
   FROM Orion.Nodes AS Nodes
   WHERE Nodes.CustomPropertyX = 'Value'

2. Use JOIN or Subqueries
   You can use JOIN statements or subqueries to refine your logic significantly, keeping only the necessary Uri and DisplayName.

   Example:
   

   SELECT Nodes.Uri, Nodes.DisplayName
   FROM Orion.Nodes AS Nodes
   JOIN Orion.NPM.Interfaces AS i ON Nodes.NodeID = i.NodeID
   WHERE i.Status = 2 -- Down interfaces

3. Suppress default results using conditions
   Another approach is to ensure that your conditions explicitly filter out unwanted results, effectively providing a "clean slate":

   SELECT Nodes.Uri, Nodes.DisplayName
   FROM Orion.Nodes AS Nodes
   
   WHERE i.Status = 2 -- Down interfaces

You can then build your logic incrementally from this point forward.

NOTE:

• Maintain the auto-populated fields (Uri, DisplayName) to ensure compatibility with alert notifications, acknowledgments, and other features.

• Use comments (--) liberally in your SWQL to document your query logic.

Hope this helps.