Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Report for triggered alerts past 1 day for 2 specified alerts only

jasonf1971

Hi All need help setting up a report for triggered alerts history for past 1 day but only on for the two alerts below

Thanks in advance

Find more posts tagged with

Accepted answers

All comments

jm_sysadmin

What Information do you need in the report? Here's something that I think is close, its SWQL.

SELECT 
    AH.AlertObjects.AlertConfigurations.DisplayName as [Alert Name],
    AH.AlertHistoryID, 
    AH.EventType, 
    AH.Message, 
    AH.TimeStamp,
    AH.AlertObjects.EntityCaption, 
    AH.AlertObjects.EntityDetailsUrl, 
    AH.AlertObjects.RelatedNodeCaption, 
    AH.AlertObjects.RelatedNodeDetailsUrl
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
    and AH.EventType = 0 -- Event for alert trigger
Order By AH.TimeStamp DESC

jm_sysadmin

I had to edit it, bad copy/paste

jasonf1971

Just how many times over the past 24 hours the alert triggered

jm_sysadmin

If you want the count, then try:

SELECT 
    Count( AH.AlertHistoryID) as [Alerts Triggered]
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours

    and AH.EventType = 0 -- Event for alert trigger

But in either case that looks like the report page, so make sure your data source is using 'SWQL' if it is, then I am not sure why it doesn't run. We will have to look deeper.

jasonf1971

Need to add also the following alert name -

Meraki Device Interface Down (P3)

Not sure on swql structure for this

bijuk

Are you expecting something like this?

Deltona

Try this in your Custom Table resource (SQL Query, not SWQL)

SELECT
Name 'Alert Name'
,EntityCaption 'Object of Alert'
,COUNT(1) 'Times Alert Triggered'
FROM AlertHistoryView
WHERE EventTypeWord = 'Triggered' AND ((Name = 'Cisco Store Router Down') OR (Name = 'Meraki Device Down (P3)') OR (Name = 'Meraki Device Interface Down (P3)))
AND TimeStamp > (GETDATE()-1)
GROUP BY Name, EntityCaption