SWQL or SQL alert for UNDP value change from previous poll?

Question

I tried setting up an alert for this using the Alert Wizard and found out from SolarWinds support I have to write an SWQL script for this to work and they don't support that so hope Thwack can help.

We are monitoring an OID which is a serial number that changes when a pair (HA) fails over so we want to set up an alert when the change happens. We need to have it check a previous poll for the original serial number and check it against the current poll and if they are different trigger the alert. We have 1000's of devices that do this so can't do it on specific serial numbers it has to be generic.

I haven't been able to work out how to get the value from a previous poll which I know is in the DB and check it against the current poll.

Has anyone done this as I haven't been able to find it in Thwack only on values where they are compared numerically not a text field.

I guess we have to use a datediff setting and maybe a case in the WHERE statement but just haven't been able to work it out.

Time travel required.

Z,

zyontist · Answer

Marc,

Thanks for the link I did checkout your GitHub too - thanks very useful indeed.

I have set up the alert for our site and waiting on the Firewall team to do a fail over test to see if it works. Running it as SQL looked good on the DB though.

We did the test today and it worked - I need to refine it a little as the Rows means we had too many alerts but I can see what I need to do there. Once again thanks for your help.

Thanks again for your help,

Z

mesverrum · Answer

I keep a bucket of code in my github on my signature and I know last week a few other MVP's were talking about setting up a repo but I'm not sure that it's in effect yet.

In the mean time this thwack post also has a pretty solid collection https://thwack.solarwinds.com/t5/THWACK-Community-Discussions/How-to-do-various-customizations-with-your-Solarwinds/td-p/371780

zyontist · Answer

Thanks for the quick response - I will see if I can use that in my situation - it's the polling DataTime I have been struggling with and then getting it into an Alert when SolarWinds doesn't just allow SQL commands you have to fit it into what it gives you to start with. Looks very similar to what I had having the nested select statements and obviously your DateTime is better than what I had I just couldn't work out how to get it into the Alert. I also see I should have been using a different SQL condition on the Custom table rather than just the Custom Node.

I'll report back when I get it working.

Thanks again.

Z.

PS wonder if it's worth setting up a website to help users set up SWQL/SQL code as SolarWinds doesn't support it and you get pointed to that option a lot I find and I am no script expert but can manage some.