SWQL CASE Function

i would like to display the severity of each alarm , i noticed that the value returned is a number and i'm working on a way to change the value into something else .

i tried the CASE function as shown belwon but i'm getting error in the syntax:


OAH.AlertObjects.AlertConfigurations.DisplayName AS [Alert Name]

, OAH.AlertObjects.AlertConfigurations.AlertID AS [Alert ID]

, COUNT( AlertHistoryID ) AS [Last 30 Days]


When AC.Severity=1 then 'Warning'

When AC.Severity=2 then  'Critical'

ELSE AC.Severity

end AS [ Criticité ]

FROM Orion.AlertHistory OAH

INNER JOIN Orion.AlertConfigurations as AC on AC.AlertID = OAH.AlertObjects.AlertConfigurations.AlertID

WHERE EventType = 0 and  oah.AlertObjects.AlertConfigurations.AlertID IN ('714','618','735','732','941','942')  AND  OAH.TimeStamp > GetUtcDate()-30

GROUP BY oah.AlertObjects.AlertConfigurations.AlertID

this CODE is working Fine without the CASE function.

Thanks for any help you can offer.

  • For everything other than alert configurations It can be easier to join the orion.statusinfo table for this sometimes

    for ACs i use this block

    WHEN ao.AlertConfigurations.Severity = 1 then '<b><p style="color:red">Critical</p></b>'
    WHEN ao.AlertConfigurations.Severity = 2 then '<b><p style="color:orangered">Serious</p></b>'
    WHEN ao.AlertConfigurations.Severity = 3 then '<b><p style="color:Orange">Warning</p></b>'
    WHEN ao.AlertConfigurations.Severity = 0 then 'Informational'
    WHEN ao.AlertConfigurations.Severity = 5 then 'Notice'
    END AS [Severity]

    Which is almost literally the same as yours, seashore's answer is correct and your syntax looks alright

  • Hey Adam, tanks for your answer.

    i tested your answer cause it looks very interesting to format the display of the severity but it didn't work work me: 

Reply Children