Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SWQL query: custom poller (status or currentValue) != x for last 12 hours

Is it possible to write a SWQL query for a dashboard widget that would have a WHERE clause similar to this:

WHERE custom poller (status or currentValue) != x for last 12 hours

I can write a SWQL query against the various custompoller tables (i.e. custompollerstatistics), where it equals or does not equal some value, that's easy. But what I can't seem to figure out, is how to do basically what we do in Alerts Trigger condition, where we say "Condition must exist for more than xx hours". Even if we build a query with dropdowns and such (in Alerts/Trigger condition), then have it show us the resulting SWQL query, that doesn't actually help in this scenario, because it does not include the "Condition must exist for more than xx hours" portion.

I know the UnDP poller has history enabled, so I would hope the data should be available. But how do I query and say "the currentValue != to xx, and has been that way for xx hours)? Hopefully there is a simple way that I'm just not seeing yet.

Thanks in advance!!

Find more posts tagged with

Accepted answers

All comments

Seashore

Interesting question!

One idéa. If you get all the historical values for last 12 hours, do an average on that. If the average is equal to your threshold then show the value. Or do a MIN, to show the minimum value.

Can that work?

mrxinu

That's exactly how I would do it. There's an advanced SWQL/SQL option for the trigger, and that's where I would write it. There's an upper portion that you can't modify (the SELECT and FROM), but from there down, you have complete control. You'll need two values: the average over X hours for Y poller on the Z device, and the current value from Y poller on the Z device. Write the WHERE condition such that when the result of the first part exceeds the result of the second part, you get a single row back from the Z device, and you've got your trigger.

If it sounds confusing, it's because it is. If you want to give it a go based on what I've written above, I'm sending maximum good vibes. If it's too much, let me know that also, and we can coordinate a Webex or something to go through it.

clarv02

Thank you both for the quick replies!!

As it turns out, the actual condition I'm looking for is Status != 0, for some period of time (say, 24 hrs). Since I'm looking for 0, does that somewhat simplify the query?

and...thanks for sending those good vibes

clarv02

also...what do you guys think about using a UnDP Transform? Like the ColumnSum, something like this:

https://thwack.solarwinds.com/t5/NPM-Discussions/Transform-Undp-Table-Result-Sum/m-p/598918

I played with it just now, but couldn't figure out if it is able to sum values over time (or last records in the table)

mrxinu

If you need the poller to be 0 for 12 hours, this would work. I did the math for 24 hours by mistake, but just halve that.