Solarwinds alert on volume

Question

Hi 
 I would like to alert on volume space, and in the message mention the volume letter (Windows) or mount path (Linux), So I use variables in the "alert action" message box. When I use the " caption " variable (for volume) I get a good result for Linux machines, but for Windows machines I get the " c:\ " drive together with some non relevant text, for example "c:\ label 1234324 " (or something like that). 
 Now, instead the " Caption " variable I can use the "Device ID " variable which work find for Windows (fetch exactly c:\), but for Linux it fetch the physical drive, and not the mount point (I need the mount point) 
 So what is the best why to bring the exact " c: " for windows and / var (for example) for Linux? 
 Thanks

donrobert5 · Answer

Can you just add both and then add in machine type so you know if it's Windows or Linux?

shuth · Answer

You could try something like the below query. If it detects a Windows node, it will use the DeviceID otherwise it will use the normal caption. I added an additional check because it looks like the DeviceID is only collected on Windows with WMI/Agent - an SNMP node doesn't have the DeviceID. But you can tweak the query from here. 
 ${N=SWQL;M=SELECT CASE WHEN v.Node.Vendor = 'Windows' AND DeviceID <> '' THEN DeviceID ELSE Caption END AS [VolumeLabel] FROM Orion.Volumes v WHERE VolumeID = ${N=SwisEntity;M=VolumeID} }