nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Report for triggered alerts past 1 day for 2 specified alerts only

jasonf1971

Hi All need help setting up a report for triggered alerts history for past 1 day but only on for the two alerts below

Thanks in advance

Find more posts tagged with

Accepted answers

All comments

jm_sysadmin

What Information do you need in the report? Here's something that I think is close, its SWQL.

SELECT 
    AH.AlertObjects.AlertConfigurations.DisplayName as [Alert Name],
    AH.AlertHistoryID, 
    AH.EventType, 
    AH.Message, 
    AH.TimeStamp,
    AH.AlertObjects.EntityCaption, 
    AH.AlertObjects.EntityDetailsUrl, 
    AH.AlertObjects.RelatedNodeCaption, 
    AH.AlertObjects.RelatedNodeDetailsUrl
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
    and AH.EventType = 0 -- Event for alert trigger
Order By AH.TimeStamp DESC

jm_sysadmin

I had to edit it, bad copy/paste

jasonf1971

Just how many times over the past 24 hours the alert triggered

jm_sysadmin

If you want the count, then try:

SELECT 
    Count( AH.AlertHistoryID) as [Alerts Triggered]
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours

    and AH.EventType = 0 -- Event for alert trigger

But in either case that looks like the report page, so make sure your data source is using 'SWQL' if it is, then I am not sure why it doesn't run. We will have to look deeper.

jasonf1971

Need to add also the following alert name -

Meraki Device Interface Down (P3)

Not sure on swql structure for this

jm_sysadmin

SELECT
    AH.AlertObjects.AlertConfigurations.DisplayName, 
    Count( AH.AlertHistoryID) as [Alerts Triggered]
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
    and AH.EventType = 0 -- Event for alert trigger
Group By AH.AlertObjects.AlertConfigurations.DisplayName

Is this what you mean? Group counts by name

jasonf1971

sorry i didnt make it clear enough i need the following alert added into the swql as well

Meraki Device Interface Down (P3)

jasonf1971

so basically, it will report on 3 alerts

jm_sysadmin

I missed the word interface, thought it was the same, sorry

SELECT
    AH.AlertObjects.AlertConfigurations.DisplayName, 
    Count( AH.AlertHistoryID) as [Alerts Triggered]
FROM Orion.AlertHistory AH
Where 
       (AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)' 
    or  AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Interface Down (P3)' )
    and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
    and AH.EventType = 0 -- Event for alert trigger
Group By AH.AlertObjects.AlertConfigurations.DisplayName

jasonf1971

anyway we can add the alert Count to the following swql - Count( AH.AlertHistoryID) as [Alerts Triggered]

SELECT
AH.AlertObjects.AlertConfigurations.DisplayName as [Alert Name],
AH.AlertHistoryID,
AH.EventType,
AH.Message,
AH.TimeStamp,
AH.AlertObjects.EntityCaption,
AH.AlertObjects.EntityDetailsUrl,
AH.AlertObjects.RelatedNodeCaption,
AH.AlertObjects.RelatedNodeDetailsUrl
FROM Orion.AlertHistory AH
Where
(AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
or AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)'
or AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Interface Down (P3)' )
and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
and AH.EventType = 0 -- Event for alert trigger
Order By AH.TimeStamp DESC

thanks

stevenstadel

Try adding the Count as another property.

SELECT
AH.AlertObjects.AlertConfigurations.DisplayName as [Alert Name],
Count (AH.AlertHistoryID) as [Alerts Triggered],
AH.AlertHistoryID,
AH.EventType,
AH.Message,
AH.TimeStamp,
AH.AlertObjects.EntityCaption,
AH.AlertObjects.EntityDetailsUrl,
AH.AlertObjects.RelatedNodeCaption,
AH.AlertObjects.RelatedNodeDetailsUrl
FROM Orion.AlertHistory AH
Where
(AH.AlertObjects.AlertConfigurations.DisplayName like 'Cisco Store Router Down'
or AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Down (P3)'
or AH.AlertObjects.AlertConfigurations.DisplayName like 'Meraki Device Interface Down (P3)' )
and HOURDIFF(AH.TimeStamp , GetDate()) < 24 -- last day in hours
and AH.EventType = 0 -- Event for alert trigger
Order By AH.TimeStamp DESC

jasonf1971

i have tried adding the alert triggered table to the report, but it is only picking up one of the alert names instead of 3

stevenstadel

Here is another query. I commented the AlertID out, it may be easier to use that in the future.

SELECT COUNT([AH].AlertHistoryID) AS [Alerts Triggered]
     , [AH].AlertObjects.AlertConfigurations.DisplayName as [Alert Name]
--     , [AH].AlertObjects.AlertConfigurations.AlertID
     , [AH].EventType
     , [AH].Message
     , [AH].TimeStamp
     , [AH].AlertObjects.EntityCaption
     , [AH].AlertObjects.EntityDetailsUrl
     , [AH].AlertObjects.RelatedNodeCaption
     , [AH].AlertObjects.RelatedNodeDetailsUrl
FROM Orion.AlertHistory AS [AH]
WHERE [AH].EventType = 0
  AND [AH].TimeStamp >= ADDHOUR(-24,GETDATE())
--  AND [AH].AlertObjects.AlertConfigurations.AlertID in (584, 555, 582, 504, 139)
  AND [AH].AlertObjects.AlertConfigurations.DisplayName in ('Cisco Store Router Down', 'Meraki Device Down (P3)', 'Meraki Device Interface Down (P3)')
GROUP BY [AH].Message
ORDER BY [AH].TimeStamp DESC

bijuk

Are you expecting something like this?

Deltona

Try this in your Custom Table resource (SQL Query, not SWQL)

SELECT
Name 'Alert Name'
,EntityCaption 'Object of Alert'
,COUNT(1) 'Times Alert Triggered'
FROM AlertHistoryView
WHERE EventTypeWord = 'Triggered' AND ((Name = 'Cisco Store Router Down') OR (Name = 'Meraki Device Down (P3)') OR (Name = 'Meraki Device Interface Down (P3)))
AND TimeStamp > (GETDATE()-1)
GROUP BY Name, EntityCaption