How to create a simple Alert with SWQL?

ralch

Hi,

We want to create an alert when one of our interfaces stop receiveng Netflow data.

So I the Alert Manager we created an alert and it produces the following SWQL:

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.NPM.Interfaces AS E0

WHERE ( ( E0.[NetflowSource].[LastTime] < '20170120 16:30:00' ) )

However instead of using a fixed date I need to use GetDate() since we are supposed to receive netflows constantly.  So I believe it should be a simple thing of using the following:

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.NPM.Interfaces AS E0

WHERE ( ( E0.[NetflowSource].[LastTime] < GetDate() ) )

Unfortunately the web interface of Solarwinds expects two fixed values.  One for date and another for the time.   This interface does not allow to continue unless I specify two fixed values but that would not work as we expect.

When I inspect the generated SWQL, the interface does not allow to rewrite the query. 

How could I solve this problem?

Thank you

ralch

I found out about Create custom SQL alerts from the Web Console - SolarWinds Worldwide, LLC. Help and Support

But when entering the fowllowing customized SWQL

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.NPM.Interfaces AS E0

WHERE ( ( E0.[NetflowSource].[LastTime] < GetDate() ) )

The web interface says it is not valid

Is it possible to do this type of alert with Solarwinds and NTA?