We are investigating this canned alert "Download Config requested by job failed" and have created a duplicate so we can play around with it The alert works and when the action is set to email then that also works, but the output is very limited / crude.
Now I know that the numbers at the end equal the Node ID but... we'd like to be able to include, amongst other aspects, the actual name of the node. Certainly that would help us when we turn this into an automated alert for raising an incident.
If I do a show SWQL on the condition tab, I can see and understand what it is doing - for completeness sake that SWQL is:
SELECT E0.[Uri], E0.[DisplayName] FROM Cirrus.Audit AS E0 WHERE ( ( E0.[Action] = 'Download Config requested by job' ) AND ( E0.[DateTime] > '20210322 00:00:00' ) AND ( E0.[Type] = 'Failed' ) )
So far so good.
However, I can't see where it is extracting the NodeID from - if I load the above query into the SDK all I get back are entries like:
>> swis://NAME_of_Server/Orion/Cirrus.Audit/ID=B8C77171-5C94-4649-8391-0000CAA7BEE6
No names, no NodeID's that relate to the eMail output and so my
First question is how does that string of numbers/letters after the 'Audit/ID=' get translated to the output in the email? I guess I'm asking why I don't see in the SDK the info n the eMail?
Second question: can I add in (via a JOIN) a second table - specifically NCM.Nodes - so as to be able to utilise some of the entries in that to firstly be able to add a node name to the output and more specifically, within my trigger actions and variable insertion?
