Hi,
I am trying to create a custom query window, that when an alert is triggered, it will only be displayed inside the query window for '5 Minutes', after the 5 minutes mark, the alert should disappear from the (5 min) Windows, then move up to the (10 Minute) query window with different escalation (alert name).
I have created a sample query of the Alerts View below, but I'm not sure how I can put a filter by 'where 'active time' > 5 minute'.
Please help. Thank you in advance!
SELECT DISTINCT
o.AlertConfigurations.Name AS [ALERT NAME]
,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]
,Case
WHEN o.AlertConfigurations.Severity = '0' THEN ('/Orion/images/ActiveAlerts/Serious.png')
WHEN o.AlertConfigurations.Severity = '1' THEN ('/Orion/images/ActiveAlerts/Warning.png')
WHEN o.AlertConfigurations.Severity = '2' THEN ('/Orion/images/ActiveAlerts/Critical.png')
WHEN o.AlertConfigurations.Severity = '3' THEN ('/Orion/images/ActiveAlerts/InformationalAlert.png')
WHEN o.AlertConfigurations.Severity = '4' THEN ('/Orion/images/ActiveAlerts/Notice.png')
End as [_IconFor_ALERT NAME]
,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE]
,o.EntityCaption AS [ALERT OBJECT]
,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]
,CASE WHEN o.AlertActive.TriggeredDateTime IS NULL THEN NULL ELSE (
TOSTRING(FLOOR(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +
TOSTRING(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())%60) + 'm'
) END AS [ACTIVE TIME]
,o.RelatedNodeCaption AS [RELATED NODE]
,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]
FROM Orion.AlertObjects o
left join orion.nodes n on n.caption = o.EntityCaption
LEFT JOIN Orion.AlertSuppression Supp ON n.Uri = Supp.EntityUri
WHERE o.AlertActive.TriggeredMessage <> '' and o.AlertConfigurations.Name = 'TEST-Critical' AND (Supp.ID IS NULL OR (Supp.SuppressFrom > GETUTCDATE() AND (Supp.SuppressUntil IS NULL OR Supp.SuppressUntil > GETUTCDATE())))
ORDER by o.AlertActive.TriggeredDateTime
