Modern Dashboard - Active Alerts Acknowledgement

ok I have fixed it by amending a part of the code to 

There is an AcknowledgedDateTime in the Orion.AlertActive SWQL table. You could try modifying your WHERE clause to only show alerts where the difference between AlertActive.AcknowledgedDateTime and the current UTC time is < 7 days? Not sure if you need < or <= so test it out.

WHERE DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) <= 7

If you mean removed from the system completely, you could probably find a way to clear out the alert but if the trigger condition still exists then the alert will retrigger immediately anyway.

Just removed from the report. Ok thanks will give that a try.

I've incorporated the swql, but now it is only displaying devices that have been actioned within 7 days. I need it to remove these actioned items after x amount of days from the report please. I have tried it with an = as well with the same outcome. Any ideas cheers?

SELECT DISTINCT
AlertObjects.EntityDetailsURL,
Nodes.Caption AS NodeName,
Nodes.Status as NodeStatus,
Nodes.DetailsURL,
'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+tostring(AlertObjects.AlertObjectID) AS AcknowledgeIt,
'Acknowledge' As AckLabel,
AlertActive.AlertActiveID, AlertObjects.AlertObjectID, AlertConfigurations.Name, AlertConfigurations.Severity, AlertConfigurations.ObjectType,
AlertObjects.EntityUri, AlertObjects.EntityType, AlertObjects.EntityCaption,
ToLocal(AlertActive.TriggeredDateTime) AS TriggeredDateTime, AlertObjects.LastTriggeredDateTime, AlertActive.TriggeredMessage AS Message,
AlertActive.AcknowledgedDateTime, AlertActive.Acknowledged AS Acknowledged, AlertActive.AcknowledgedBy, AlertActive.AcknowledgedNote,
Case
When Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400)>0 Then
ToString(ToString(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) +0.0)/86400))+'d '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600)>0 Then
ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60)>0 Then
ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
Else ''
End AS ActiveTime
FROM Orion.AlertObjects (nolock=true) AlertObjects
INNER JOIN Orion.AlertActive (nolock=true) AlertActive ON AlertObjects.AlertObjectID=AlertActive.AlertObjectID
INNER JOIN Orion.AlertConfigurations (nolock=true) AlertConfigurations ON AlertConfigurations.AlertID=AlertObjects.AlertID
INNER JOIN Orion.NodesCustomProperties (nolock=true) NodeCP ON AlertObjects.RelatedNodeID = NodeCP.NodeID
INNER JOIN Orion.Nodes (nolock=true) Nodes ON AlertObjects.RelatedNodeID = Nodes.NodeID
where Nodes.Caption like '%device%' AND DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7
Order By AlertConfigurations.Name, AlertObjects.EntityCaption

With the additional where clause it is probably only showing alerts that have been acknowledged.

You might be able to try something like the below but I haven't tested it. Should show any alerts that match your caption filter, and have either not been acknowledged or have been acknowledged for more than 7 days.

WHERE Nodes.Caption like '%device%' AND (
    (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
    OR
    AlertActive.AcknowledgedDateTime IS NULL
    )

Edit: Following comments below, updated code from IS NOT NULL to IS NULL, removed additional clause.

With the additional where clause it is probably only showing alerts that have been acknowledged.

You might be able to try something like the below but I haven't tested it. Should show any alerts that match your caption filter, and have either not been acknowledged or have been acknowledged for more than 7 days.

WHERE Nodes.Caption like '%device%' AND (
    (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
    OR
    AlertActive.AcknowledgedDateTime IS NULL
    )

Edit: Following comments below, updated code from IS NOT NULL to IS NULL, removed additional clause.

I am getting 

Looks to be this section of the code

AlertActive.AcknowledgedDateTime = ' '

when I have just have this it still only brings back the 3 acknowledged items and does not show any un-acknowledged items still.

WHERE Nodes.Caption like '%device%' AND (
    (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
    OR
   AlertActive.AcknowledgedDateTime IS NOT NULL
    )

think I may have it

WHERE Nodes.Caption like '%Device%' AND (
    (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
    OR
   AlertActive.AcknowledgedDateTime IS NULL
    )

Ooops, yes.  "IS NULL" for the ones where you haven't acknowledged it yet as those alerts won't have a DateTime value yet. 

You should be fine without the = '' clause. That was more for if you acknowledge an alert and then unacknowledge it, I'm not sure if the DateTime will go back to NULL or an empty field ( '' ).

EDIT/UPDATE: I did a quick test. If you unacknowledge an alert, the field reverts to NULL in the database so you should be fine with just the additional "IS NULL" check.