Can't change the SELECT statement in a custom SWQL alert

Question

Hello

I want to create a custom alert using the following query:

SELECT DISTINCT NodeID, IP_Address, Caption, ObjectSubType

FROM Orion.CPULoad JOIN Orion.Nodes ON CPULoad.NodeID = Nodes.NodeID

WHERE CPULoad.NodeID IN (

SELECT DISTINCT NodeID FROM Orion.Nodes

WHERE

(ObjectSubType IN ('Agent') AND Nodes.UnManaged = '0')

)

AND CPULoad.NodeID NOT IN (

SELECT DISTINCT NodeID FROM Orion.CPULoad

WHERE DATETIME > ADDDATE('HOUR',-10,GetDate())

)

My issue is that when creating a custom SWQL alert in Orion, the SELECT statement is greyed out and can't be changed. Why is this?

tony.johnson · Accepted Answer

The use of a custom SWQL query is bound to SELECT statements for the selected entity. You may need to use a nested query to include the hardcoded fields such as

SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes

WHERE Nodes.Uri In

(

Your query here

)

Here is an example of something similar I worked https://thwack.solarwinds.com/resources/thwack-emea/f/forum/13727/ipam---how-to-alert-when-an-i-p-address-changes-status/120285#120285