Request for suggestion On Node & Interface Down Alerts

I'd say a modern dashboard is perfect for this idea. Create a custom SWQL code block with whatever details your company requires and then use an MD to display nodes and interface alerts side by side, or one above the other.

I think your biggest challenge will be in how to extract the data. A quick scroll through SWQL Studio shows me several tables that could help [Orion.AlertActive being the most promising] but how you "restrict" the data to current active alerts is the challenge. You could go with an approach that says: "if alert is not acknowledged then it must be Active" type of logic, but that relies on your users correctly acknowledging alerts in a timely manner. 

I think a better approach [or at least one I'd prefer and find useful] would be to show the alerts that triggered today. Then perhaps you could create multiple views for yesterday, this week, etc...

Hi stuartd ,

I'm experiencing difficulties in writing a query. Could you assist me by providing a SWQL query that I can use in my Modern Dashboard table widget? On one Modern dashboard, I need to display two types of active alerts as mentioned below:

1. The dashboard should display active alerts for nodes that are down, specifically for nodes with an ownership value of 'FKT'.

2. The dashboard should display active alerts for interfaces that are down, specifically for interfaces with an ownership value of 'FKT'.

-_-Thanks in Advance.

I tried using your given idea, but it's now working and showing error as shown below

You are using the DatabaseManager and not the SWQL Studio.

You can't execute a SWQL query in DatabaseManager.

Try to download and install the SWQL Studio https://github.com/solarwinds/OrionSDK/releases

As a reference i paste that SQWL query and the same query i tried in the Modern dashboard but it's not working. I tried a new swql query as mentioned below and it's not giving any error neither any data is not showing.

Can you try to remove the WHERE condition ?

It's showing data, if i remove Where clause or if I add this "WHERE o.AlertActive.TriggeredMessage <> ''

But, I need only those active alerts which is related to node down and node ownership is FT

Do you have SWQL studio installed yet? If not, start there

Not installed, I am testing the query directly in the Modern dashboard query section. Below mentioned query is almost showing all the data which i required, except Active alert time and Acknowledge status is not showing.

SELECT
o.AlertConfigurations.Name AS [ALERT NAME]
,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]
,o.EntityCaption AS [ALERT OBJECT]
,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]
,o.RelatedNodeCaption AS [RELATED NODE]
,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]
,o.Node.IP_Address AS [IP ADDRESS]
,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE]
,CASE
WHEN o.AlertConfigurations.Severity = 1 then 'Critical'
WHEN o.AlertConfigurations.Severity = 2 then 'Serious'
WHEN o.AlertConfigurations.Severity = 3 then 'Warning'
WHEN o.AlertConfigurations.Severity = 4 then 'Informational'
WHEN o.AlertConfigurations.Severity = 5 then 'Notice'
END AS [Severity]
FROM Orion.AlertObjects o
WHERE o.AlertActive.TriggeredMessage <> ''
and o.AlertActive.TriggeredDateTime >= ADDHOUR(-720, GETDATE())
and o.AlertConfigurations.Name='Node is Down'
ORDER by o.AlertActive.TriggeredDateTime DESC

Get SWQL studio working, trying to work this any other way will lead to confusion

you'll get error messages and in-line autocomplete and error detection

 ImNishat If you are having a hard time getting SWQL studio installed you need to download the SolarWinds SDK. That link will take you to the page, just download the .MSI

if not SWQL studio , try to run it in the SWIS page - https://yourdomain/orion/Admin/swis.aspx that way you can validate your query in quicker time , have you find a solution already 

if not SWQL studio , try to run it in the SWIS page - https://yourdomain/orion/Admin/swis.aspx that way you can validate your query in quicker time , have you find a solution already