Using "Custom SWQL Alert"

Question

Hello,

We have a lot of snmp traps that are sent to SolarWinds.  I'm trying to create a "cookie cutter" alert that uses alert custom properties.  This way, when I have to create a new snmp alert, I only have to update the alert custom properties and the rest of the alert will use the already configured settings.  I've been banging my head for several hours trying to figure out what I'm doing wrong, please see below.

I've populated the alert custom properties as shown below (I have it set to look back 200 minutes for testing):

The "sw_test" is the string that I want to search for in the "message" of the snmp trap.

When I use the alert custom property in my search and I go to the "Summary" tab, it doesn't detect the search string.

Below is from the "summary" tab.

When I do not use the custom property and enter the search string directly into the query it works like a charm

Below is from the "summary" tab.

The really odd thing is that in my "email" trigger action, if I put the query in it finds the text..

cmarti · Answer

Yeah, I never could get it to work so I ended up having to hard code my search text in the query.  I appreciate the reply.

adam.beedell · Answer

I dont/didnt think you couldnt evalute macros like that in an alert definition. This'd be better placed in the NPM or LEM or platform forums really, not much connection to SAM

The SQL macro is just trying to evaluate SQL, so removing the macro formatting would work fine, you'd have to join or subquery to the alertconfigurationscustomproperties table using some ID or name or unique property. One update per alert seems ok?

Usually you'd do these via the log alerting -> npm alerting integration, which i have my issues with, but it goes keep all your alertable phrases in one place i suppose.

cmarti · Answer

Thank you for your reply.  This is what I'm using in copy/paste form

where nodes.nodeid in
(select nodeid from orion.traps t
  where t.datetime > addminute(-200,getutcdate()) and t.message like '%${SQL: SELECT SNMPTrap_SearchString FROM AlertConfigurationsCustomProperties where AlertID=${N=Alerting;M=AlertID}}%'
)

When I replace the '%${SQL: SELECT SNMPTrap_SearchString..." with the actual string it works, but I'm needing the query to work.