nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Need a report showing alerts acknowledged

pratikmehta003

Hi All,

Can anyone help me with a report which will show details of who has acknowledged the alerts... When i m trying to build with alert history, i m getting duplicate instances and report is not coming accurate...

Find more posts tagged with

acknowledge report

Accepted answers

xaturbatu

Use this SWQL in reports and tell me if it's what you are looking for.

SELECT ah.TimeStamp, ah.AccountID, ah.Message, ao.EntityCaption, ao.RelatedNodeCaption, ao.TriggeredCount, ao.RealEntityType

FROM Orion.AlertHistory ah

left join orion.alertobjects ao on ao.AlertObjectID=ah.AlertObjectID

where eventtype=2

order by ah.timestamp desc

All comments

mesverrum

Might help if you showed what you have so far?

xaturbatu

Use Alert Object instead of Alert History and Alert History/EventType equal to 2, which is the acknowledge. Alert History/AccountID will tell you the username. Other details you might need are on the Alert Object table.

pratikmehta003

that too did not help

pratikmehta003

sure..

This is what i get the output as:

So its like for 1 CI, i get 3 duplicate entries.. and in some cases m not even getting details of alerts which is actually ack by my team...

so any help would be much appreciated...

xaturbatu

Use this SWQL in reports and tell me if it's what you are looking for.

SELECT ah.TimeStamp, ah.AccountID, ah.Message, ao.EntityCaption, ao.RelatedNodeCaption, ao.TriggeredCount, ao.RealEntityType

FROM Orion.AlertHistory ah

left join orion.alertobjects ao on ao.AlertObjectID=ah.AlertObjectID

where eventtype=2

order by ah.timestamp desc

pratikmehta003

thanks a lot... something like this only i was looking for..

Any variable that i can use to show the alert name that was triggered?