This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Report to show all alert generated events within a certain date and time range.

Hello all, I am looking to create a report that will show all alert generated events regardless of state; whether it is active, acknowledge, reset, etc within a certain date and time range. I want to be able to do this so I can tell if alerts are not being triggered to the appropriate parties and a few other reasons. I am a SWQL noob but have experience reading through code. Any help/advice is greatly appreciated.

  • This should all be in the Orion.AlertHistory table in SWQL.  It's easiest to explore it using the SWQL Studio which can be downloaded from the Orion SDK GitHub Releases Page.

    I put this together in a few moments, but it has zero filtering (not even for the date)

    SELECT [History].AlertHistoryID
         , [History].EventType
         , [History].Message
         , [History].TimeStamp
         , [History].AccountID
         , [History].AlertActiveID
         , [History].AlertObjectID
         , [History].AlertObjects.EntityCaption
         , [History].ActionID
         , [Actions].Title
         , [Actions].Description
    FROM Orion.AlertHistory AS [History]
    LEFT JOIN Orion.Actions AS [Actions]
      ON [History].ActionID = [Actions].ActionId

    Between the SWQL Studio and the above sample, you should have pretty much anything you would need.