Create an Alert when comparing two ComponentStatisticData values

paullcecg

I am trying to create an alert that will alert me when two Component Statistic Data values are different. I have created a Linux/unix script that returns a integer value lets say "6" and another that returns a value of "7". If I look at the node it is attached to it shows both numbers under statistical data. I cannot find how to create this in an alert. I have also tried to create a Custom SWQL Alert but when you select Set up your sqal condition and choose Application from the drop down it automatically puts in "Select Application.Uri, Application.DisplayName From Orion.APM.Application As Application" . I need it to be more like Select StatisticData From Orion.APM.ComponentAlert" but none of the drop downs apply this and it is greyed out so it can't be modified. Has anyone created a custom alert with StatisticData? I am running Orion Platform 2019.2 and SAM 6.9.1. I have downloaded and running the SWQL Studio so I can run queries against the database and return the values I need. I just don't know how to translate this into an alert. Any help is greatly appreciated!

Example..

SELECT  StatisticData

FROM Orion.APM.ComponentAlert

WHERE ComponentName = 'LCECNET'

or

SELECT  ComponentStatisticData

FROM Orion.APM.CurrentStatistics

WHERE ComponentName = 'LCECNET'

attachments.zip

jrouviere

One thing that takes a little getting used to for the custom SQL/SWQL alerts is that the initial SELECT statement is locked in as you've found, but one of the good things about SWQL is that the joins are basically baked in, so with a little bit of exploration you can typically get out the results you want, but stay constrained with how the queries are built. You talked about what your needs were for alerting, but this is due to what Orion needs for the alert to trigger.

So taking your instance, I've re-written it into a query that I think should work for you. If you aren't using it already, definitely make sure you get the expected results from SWQL Studio and then test your alert:

SELECT Application.Uri, Application.DisplayName FROM Orion.APM.Application AS Application

where (

(SELECT Component.CurrentStatistics.ComponentStatisticData from Orion.APM.Component where Component.Application.URI = '<application.uri>'

and component.displayname = '<name>')

!=

(SELECT Component.CurrentStatistics.ComponentStatisticData from Orion.APM.Component where Component.Application.URI = '<application.uri>'

and component.displayname = '<name>'))

So this isn't likely a final form, for starters, there are four parameters you'll want to update to your parameters, you'll need to find some way to pin down the application.uri or hard code it, I believe that the way you've got the query set up it becomes a circular reference where you're invoking the uri that you're trying to find for the alert and using it in the where clause.

When I set this up it returned data, but not necessarily what I would have expected so it will need some additional tweaking, but I think this should get you in the ballpark and again, testing against the data in SWQL Studio should help immensely if possible.