6 Replies Latest reply on Mar 25, 2018 7:16 AM by tayyabrao

    SWQL and Active Alerts


      I am trying to create a dashboard that has Active Alerts. We have SW integrated with Service Now so on this dashboard I want to show alerts that are assigned to a particular Assignment Group in Service Now. In SWQL Studio the query works correctly and returns the correct number of records but when I put this in as Custom Query in the dashboard no records are return.  If I remove the where clause in the dashboard it will return all of the active alerts.  Any ideas why it would not work in the dashboard, is there any limitation on the SWQL  compared to the Studio. Thanks

      SELECT ac.Name AS [Alert],  

             '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(ao.AlertObjectID) AS [_LinkFor_Alert],

             ac.AlertMessage AS [Message], 

             ao.EntityCaption AS [Object], 

             ao.EntityDetailsUrl AS [_LinkFor_Object],

             aa.TriggeredDateTime as [Triggered Date],

             ao.LastTriggeredDateTime AS [Last Triggered On], 

             ao.RelatedNodeCaption AS [Node], 

             ao.RelatedNodeDetailsUrl AS [_LinkFor_Node],

             ao.AlertIncident.IncidentNumber as [Incident Number],

             ao.AlertObjectID AS [_LinkFor_Incident Number],

             ao.AlertIncident.AssignedTo AS [Assignment Group],

             ao.AlertObjectID AS [_LinkFor_Assignment Group],


      CASE WHEN aa.TriggeredDateTime IS NULL THEN NULL ELSE (

          TOSTRING(FLOOR(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +

          TOSTRING(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())%60) + 'm'




      FROM Orion.AlertActive AS aa 

      LEFT OUTER JOIN Orion.AlertObjects AS ao ON aa.AlertObjectID = ao.AlertObjectID

      LEFT OUTER JOIN Orion.AlertConfigurations AS ac ON ao.AlertID = ac.AlertID

      WHERE ao.AlertIncident.AssignedTo = 'Global Network Services'

      ORDER BY  aa.TriggeredDateTime

        • Re: SWQL and Active Alerts

          Did some more testing and it seem as soon as I add there where clause no data comes back. When doing the same exact query in SWQL Studio it works fine

            • Re: SWQL and Active Alerts

              Do you have a view limitation applied to the dashboard?

              • Re: SWQL and Active Alerts


                I've checked that your query works fine and since the where clause is making the difference I also suspect limitations. If that would be an account limitation, you could easily check in SWQL studio by logging as user you log into Orion. However, view limitations are bind to view. Could you please clarify whether you have any limitations applied?


                Furthermore, I'd try a simplified version that does not contain any rendered node reference which is most probably where it gets filtered.


                SELECT [AC].[Name] AS [Alert]

                FROM [Orion].[AlertActive] AS [AA]

                JOIN [Orion].[AlertObjects] AS [AO] ON [AA].[AlertObjectID] = [AO].[AlertObjectID]

                JOIN [Orion].[AlertConfigurations] AS [AC] ON [AO].[AlertID] = [AC].[AlertID]

                WHERE [AO].[AlertIncident].[AssignedTo] = 'Global Network Services'




              • Re: SWQL and Active Alerts

                I also have same concern, we have around thousands of active alerts, wants to assign them to respective team but unable fetch the details.


                I want the details like alert details, node name, triggered message ,assignment group(custom property).


                the assignment group is created respective alert like node, interface, volume, application etc.


                please suggest