Looking for assistance with SWQL query

Question

Hello,

I am trying to troubleshoot a issue of high CPU usage occurring intermittently on 1200 nodes.

I found a thread where I can create a PerfMon link.

I can get a single component to work, along with overall node CPU, but I am having an issue structuring a query to be able to display 2 different components with a single link url.

I have tried a self join, but get an error about displaying a link from two different sources.

I have not had any luck with a SELECT sub query either.

I am hoping a SWQL guru can point me in the right direction.

SELECT OAA.Node.Caption

,'PerfStack_Template_A' AS [PerfStack-A]

,'ui/perfstack/?presetTime=last10Minutes

&withRelationships=true

&charts=

0_Orion.Nodes_' + TOSTRING(OAA.NodeID) + '-Orion.CPULoad.MaxLoad;

0_Orion.APM.GenericApplication_' + TOSTRING(OAA.ApplicationID) + '-Orion.APM.ProcessEvidenceChart.' + TOSTRING(OAA.Components.ComponentID) + '.MaxPercentCPU;

' AS [_LinkFor_PerfStack-A]

FROM Orion.APM.Application OAA

where OAA.NodeID = '%${SEARCH_STRING}%'

and (OAA.Components.Displayname = 'java.exe' or OAA.Components.Displayname = 'Poseidon Agent')

natetech · Answer

Thank you for the input.

Your use of the joins was exactly what I needed!

mesverrum · Answer

So just to be clear you are wanting to have this query generate a link to a perfstack that has node CPU, and the max cpu utilization of two components that are on that node?

Probably easier if you start at the node and then branch out from there, this query will only work if the node has a both the java.exe and poseidon agent monitors on it, I also changed it so your search condition is by the caption instead of nodeid.  I tested this and noticed that the gui doesn't list off the names of the component monitors, it says the name of the node and the name of the app template though so it might work for your use case.

select distinct

n.caption

,'PerfStack_Template_A' AS [PerfStack-A]

,'/ui/perfstack/?presetTime=last24Hours&charts=0_Orion.Nodes_' + TOSTRING(n.NodeID) + '-Orion.CPULoad.AvgLoad,0_Orion.APM.GenericApplication_' + TOSTRING(java.ApplicationID) + '-Orion.APM.ProcessEvidenceChart.' + TOSTRING(java.ComponentID) + '.AvgPercentCPU,0_Orion.APM.GenericApplication_' + TOSTRING(poseidon.ApplicationID) + '-Orion.APM.ProcessEvidenceChart.' + TOSTRING(poseidon.ComponentID) + '.AvgPercentCPU;' AS [_LinkFor_PerfStack-A]

FROM Orion.Nodes n

join Orion.APM.Component java on n.NodeID=java.Application.NodeID and java.DisplayName = 'java.exe'

join Orion.APM.Component poseidon on n.NodeID=poseidon.Application.NodeID and poseidon.DisplayName = 'Poseidon Agent'

where n.caption = '%${SEARCH_STRING}%'