SAM, How to show last x number of statistic messages

I have created a powershell log parser application, with a 'number of newly found strings' component.

I am using a script that actually extracts the line of text from the log file and return this in the statistic message.

This is all working and it displays the error in the statistic message field. or displays 'No newly found strings' if no regex match was found

However I want to display the last 25 statistic messages when the statistic > 0 (i.e. a regex match was found for an error)

I have hundred and hundreds of this sort of application and have found that I can do this by creating a custom report and then using the 'Filter Nodes (SQL)' with a value of

applicationname='the application name' AND nodename = 'the node name'.

However this will be a lengthy process adding this value on all application (I would need a separate view for each application)

Is there any easier way to do this, perhaps by a variable in the 'Filter Nodes (SQL)'  value that auto inserts the application name and node name?


  • Have you considered using the Advanced Alert Manager to write this value out to Orion Events and then use the Last XX Events Resource?

  • Hi aLTeReGo,

    Should the message be formated in any specific way? I do output as follows to NPM Even Log through Advanced Alert Manager:

    STATISTIC: ${StatisticData}; MESSAGE: ${ComponentMessage}

    However, when I go to the component's last 25 events - it is not there

    I can see this message in Message Center though

  • Including a multi-value script message into the text of an alert message can only be accomplished using a SQL macro. Below is an example of the SQL macro usage to add the numeric value of a multi-value script to the output of an advanced alert message.

  • Thanks aLTeReGo,

    I think that we may be talking about different things. I am trying to implement your suggestion above to use Advance Alert Manager to log and Event in Orion and then use this Event to display those historical records in Last XX Event Resource for the given component. I am not using any multi-value massages. My script has only one MESSAGE and only one STATISTIC. Here is what I do:


    Advance Alert Manager triggers the following action to log an Event



    Event is visible in Message Center alongside with other Events from same server



    However, this Event is NOT visible on the component details page in Last 25 Event resource


    Hence is my questions - do I need to format my message somehow in a specific way when triggering it, step (1), so that it is visible in Last XX Events for this component, step (3)

    Thank you,


  • Ahh I see the issue now. The problem is that the Last "XX" Component Events is filtered based on the specific type of event (component monitor), and the component ID being viewed. This cannot be replicated by events written through the Advanced Alert Manager. My recommendation above did not assume you would be using the events resource on the Component Details view using the "Last 25 Component Events" resource. Rather that you would have a record of this information in the Orion Events, which could be accessed through the Message Center, the Last XX Events summary resource, or through the Orion Report Writer. You could even use the Report Writer to further refine this down to just the information you're looking for. You might even be able to use the ComponentID macro to build a dynamic report that could be placed on the Component Details view.

  • Wow, so much to learn... so much to do...  emoticons_happy.png

    I will start digging how to "use the ComponentID macro to build a dynamic report that could be placed on the Component Details view" and in the meantime would appreciate if you can post some links to existing resources you may think can be relevant to refer to

    Appreciate your help Alter Ego emoticons_wink.png



  • Hi aLTeReGo,

    I think I have found similar thread where it is explained how to place a custom dynamic report on a node page: Determine Group Membership From Node Page

    I am wondering if the same can be achieved with web-based reporting and for this particular scenario. Basically - the goal is - to display on a component page Last XX Events with MESSAGE/STATISTIC results as logged in Orion by Alert Manager (screenshot above). Also I would appreciate if you can give some guidance how to create this dynamic reports that can be placed on component page

  • I am stuck...

    I have created report with dynamic query to go on component page. I could not however find an option to specify macros fro ComponentID, so I used NodeName instead:


    I do not have anything coming through to Component Details page Custom Report Resource unfortunately:


    If I will change above macros in report to static node name (for testing purpose only) - it works. But obviously I would want this to be dynamic



  • If you create a report for Historical - Statistic of multiple value components it allows you to speciofy application and component name

  • Sorry, you are correct

    The macro's appear not to work in the reports.

    However you can create a report and not specficy the node name and then on the user interface if you click edit on the report there is a 'Filter Nodes (SQL)' section

    I also haven't found a way to add macro's here but you can add for instance 'ApplicationName = 'xxx' (Hopefully its possible though)

    However this report is assigned to a view, so you can't even script a solution as you would need a seperate view for each application as the hard coded filter value would need to change for each