Windows Application Event Log (APM template with alerts)

Currently created an APM template for a particular Event Log ID and Log Source, and have got the Event Message to show on the alert utilising the variable ${WindowsEventMessages} and ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}

However I would like to "truncate" this event log message to only say the first 100 characters etc... Is there a way of doing this?

Perhaps

${WindowsEventMessages} =LEFT(100)

${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} =LEFT(100)

Find more posts tagged with

apm_monitoring_template

truncate

event log

apm

component monitor

variables

Alerts

apm_components

Accepted answers

All comments

Seashore

I haven't tested this yet but I would try something like this.

Create a custom variable and add the SUBSTRING SWQL function, like this:

SELECT SUBSTRING(${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} ,0,100)

The variable that is added to the alert then looks like this: ${N=SWQL;M=SELECT SUBSTRING(${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} ,0,100)}

SW_United

Thanks Seashore, unfortunately this didn't work.

Managed to get ${N=SWQL;M=SELECT SUBSTRING at the front and then the actual event log message and finally ,0,100)} at the end, e.g.

${N=SWQL;M=SELECT SUBSTRING Event ID 4720, A user account was created. ,0,100).

Don't suppose you have any other ideas that might assist with this?

Seashore

FINALLY I got it right :-)

${N=SWQL;M=SELECT TOP 1 SUBSTRING('${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}',0,150) AS [Output] FROM Orion.APM.WindowsEvent}

Use that variable. Change 150 to whatever length you want.

SW_United

I'll check this soon and let you know shortly. Thanks in advance.