This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Modern Dashboard - KPI Widget - All Alert Count for Acknowledged & Unacknowledged Alerts for a specific group

Hi All,

Trying to create a modern dashboard that displays the total number of acknowledged and unacknowledged alerts for a certain group.

I'm currently working on active Unacknowledged alerts using the SWQL query shown below.

--Unacknowledged Alerts
SELECT COUNT(AlertActiveID) AS UnacknowledgedAlertCount
FROM Orion.AlertActive
JOIN Orion.Container ON ContainerID = AlertActiveID
WHERE IsNull(Acknowledged, 0) = 0
AND ContainerID = 100 --100 is the container ID of the group

But the outcome does not match what we see in the application console for the specific technology.

Any help with review and correction will be much appreciated.

Parents
  • That join aint right

    I've got stuff like this in prod, but the query can look quite a bit different based on environmental specifics

    I think you want to join to at least a couple other alerts tables, and then to ContainerMembers where the memberID = AlertObjectID or similar.
    Note if you've got groups in groups this can get a bit weird

    If the groups are to do with some datapoint it's maybe worth commiting the datapoint to some properties for less joins. Maybe not, depends on your structure.

    There's some code examples on here already for SWQL alerts queries, many are better than what I use already

Reply
  • That join aint right

    I've got stuff like this in prod, but the query can look quite a bit different based on environmental specifics

    I think you want to join to at least a couple other alerts tables, and then to ContainerMembers where the memberID = AlertObjectID or similar.
    Note if you've got groups in groups this can get a bit weird

    If the groups are to do with some datapoint it's maybe worth commiting the datapoint to some properties for less joins. Maybe not, depends on your structure.

    There's some code examples on here already for SWQL alerts queries, many are better than what I use already

Children