Problem:
I have an alert in Orion that triggers whenever any inventory at a site goes down. Rather than issue a 1:1 alarm to incident ratio, I have a single incident being created when any number of devices go down. I don't use group containers because I don't want to manually manage over 2000 sites' inventory in containers, so this helps me keep it simple and reduce noise.
In the alert message, I would prefer to shoot over a list of down inventory, but the customer SQL results only allow for one result. Let's say 5 switches go down, I only want one alert, but I want to populate ServiceNow with the list of all five host names.
I'm looking for solutions for providing the information as easily as possible. One solution I can think of is to preconfigure a hyperlink back to Orion so that you would land on Manage Nodes with the resulting filter.
Can I feed a SWQL statement into the manage nodes Uri? For example, I want to provide a hyperlink out of ServiceNow back to Orion that inculdes some criteria, similar to the following example,
orion.myspace.net/.../default.aspx&Orion.NodesCustomProperties.AccountName LIKE '%customeraccount you love DC%'
(Orion.NodesCustomProperties.AccountName LIKE '%customeraccount you love DC%')
If not this, then any thoughts or suggestions? Are you, the Thwack gurus, doing anything similar or have similar use cases? How are you solving this?
Is there a way to print multiple rows in the {SQL:} macro? As a side note, I noticed that trying SWQL as a macro will not work.
