Custom Table acknowledging alert query

Hi Team,

I have issue with query to show node down alerts after acknowledging, when acknowledging the alert that raw disappears from the table,

our NOC dep asking to make that raw present on the custom table after they acknowledge it .

I really appreciate if someone can let me know if it is possible to make this change without affecting on restarting the alert .

NOTE: this custom chart only output 1 day down nodes .

SELECT distinct

AlertActive.TriggeredDateTime AS AlertTriggered, 'ClickToAck' AS AcknowledgeIt,

Case

  When Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400)>0 Then

  ToString(ToString(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) +0.0)/86400))+'d '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600)>0 Then

  ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60)>0 Then

  ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  Else ''

End AS ActiveTime,

AlertObjects.RelatedNodeCaption AS NODE,  concat('', tostring(AlertObjects.EntityCaption)  ,'')  AS Alert_Message 

FROM Orion.AlertObjects (nolock=true) AlertObjects 

INNER JOIN Orion.AlertActive (nolock=true) AlertActive ON AlertObjects.AlertObjectID=AlertActive.AlertObjectID

INNER JOIN Orion.AlertConfigurations (nolock=true) AlertConfigurations ON AlertConfigurations.AlertID=AlertObjects.AlertID

WHERE AlertActive.TriggeredMessage LIKE '%Node Down%' and AlertActive.Acknowledged is Null 

ORDER BY AlertTriggered DESC, RelatedNodeCaption ASC

Thanks,

Find more posts tagged with

swql query

Alert

Custom Query

customization

npm

acknowledge alerts

table_view

Accepted answers

KMSigma.SWI

I'd stop doing this in reports or custom query widgets and instead do it in Modern Dashboards. Someone's already shared a nice Alert Overview dashboard you can download and import.

All comments

KMSigma.SWI

I'd stop doing this in reports or custom query widgets and instead do it in Modern Dashboards. Someone's already shared a nice Alert Overview dashboard you can download and import.

ALP_V0

I appreciate your support , I tried your suggestion and it is still not meeting our teams requirements, the rows for each alert disappears as it get acknowledged when the actual issue is still there .

what they asking for t have a widget that shows those alerts during that day for example "node down" that shows real status of the alert and object after they acknowledge them

KMSigma.SWI

This modern dashboard does work. I just clicked on the "Unacknowledged" which was in the first line. It popped a new window and then when the dashboard refreshed it showed who acknowledged it and when.

If you have specific needs (and how you'd like the table to display), it would be best to include as much detail as possible so someone can help you.

ALP_V0

I edited the query to output alerts for only node down, in that process I added the same thing that caused the error that prevented the row to be displayed when it get acknowledged, thanks to you I could detect that which was (nolock with joints) , thanks a lot ....