Background:
The network team wanted an alert for the Percentage usage of the connections on a firewall. This is not an out of the box metric for checkpoints via SNMP so we had to find the 2 OIDs that gave the current Firewall connections (fwNumConn) and the Max limit of allowed connections (fwConnTableLimit).
From these 2 values we created the transform of VSXConnPercent which was:
VSXConnPercent = (truncate(({fwNummConn} / {fwConnTableLimit})*100,1))
So now we could make the alert below for the network team, this would send an email / raise a ticket into Service Now .
Brilliant all done, move onto the next job - NOPE, the network team Team want the original values of fwNumConn and fwConnTableLimit to be included in the alert message
Ok that's straight forward, you can just call them using SWIS naming conventions - WRONG.
Due to these values not being called out in the trigger condition its not that straight forward to call them out into the alert message as they are basically the same as your trigger conditions (Custom Poller Unique Name would be fwNumConn or fwConnTableLimit rather than VSXConnPercent) So there's no easy way of calling them out into the alert message, Well no simple 2 value SWIS variable anyway. you need to do some SWQL!
here's where the fun beings
First you need to use the SWIS query URL on your main poller - http://<SERVER NAME>/Orion/Admin/swis.aspx. Replace <SERVER NAME> with the correct IP or hostname for your environment.
And the OrionSDK Schema http://solarwinds.github.io/OrionSDK/schema/index.html
The values that are need ed for the custom poller are in a table called Orion.NPM.CustomPollerStatusOnNodeScalar - http://solarwinds.github.io/OrionSDK/schema/Orion.NPM.CustomPollerStatusOnNodeScalar.html
So armed with these 2 pieces of information you can now start to find your values. You know the name of your UDP poller and this will be that start of your Assignment name.
Go to the SWIS query URL and in the Select Entity drop down box find Orion.NPM.CustomPollerStatusOnNodeScalar
If you now click the Generate Select Query, this will populate a select query in to the box below.
Now click the Execute Query - this will no run your select query on the table and give you the list of all the values within the table for all of your nodes - you should see lots of values come back and you'll be able to see your UDP value names in the start of the AssignmentName field, but how to get these into your Alert message - Use SWQL (SolarWinds Query Language) within the SWIS statements.
But first we need a few more bits of information.
So In our case we have the following values that we've already put into the alert message:
Custom Poller Description = ${N=SwisEntity;M=CustomPoller.Description} <this will pull the description that you have given to your UDP> - in our case this is "Percentage of the VS Connection Used"
Node Caption= ${N=SwisEntity;M=Node.Caption} <this will give you the caption/name of your node> eg firewall01
Custom Poller Unique Name = ${N=SwisEntity;M=CustomPoller.UniqueName} <This is the Unique name of the Poller> - VSXConnPercent
Custom Poller Status Scalar Raw Status = ${N=SwisEntity;M=CustomPollerStatusScalar.RawStatus} this is the numeric value of the transformed data
We need to get the nodeID as a SWIS statement so that we can pass this in our SWQL statement to get the additional information back
NodeID = ${N=SwisEntity;M=Node.NodeID}
So we want to create a SWQL statement that will give the RawStatus value of the Current connection count for the alerting node and the RawStatus of the Maximum Connection Settings
Connection count = ${N=SWQL;M=SELECT RawStatus from Orion.NPM.CustomPollerStatusOnNodeScalar where NodeID=${N=SwisEntity;M=Node.NodeID} and AssignmentName like 'fwNumConn%'}
Maximum Connection Setting = ${N=SWQL;M=SELECT RawStatus from Orion.NPM.CustomPollerStatusOnNodeScalar where NodeID=${N=SwisEntity;M=Node.NodeID} and AssignmentName like 'fwConnTableLimit%'}
They will pull back the 2 values we need so that are network guys are happy and have all of the additional information they need in the alert message.
Things to Note the SWQL statements are case sensitive and so make sure you get your CapitalisationRight.
Hope this helps someone, I know i have been trying to work this out for quite a while, and as every I want to impart this knowledge onto the rest of the THWACK community - I hope this helps someone else 
