Custom report for all triggered instances of a single alert

Hello,

I'm trying to build a custom report that lists all currently triggered instances of an alert named "BOF Display - Node Down". This report needs to include the node name, IP, Acknowledgement status, and the ServiceNow incident number. I just cannot wrap my head around the SWQL query needed to generate this report. Any help is appreciated

Parents
  • Hi NoitswithaK,

    Try this SWQL query, I think it'll get you pretty close to where you want to be.  We don't have ServiceNow in our environment, so that's the piece that i cannot help you with.

    BTW, this was written for a Modern Dashboard view, so you may have to remove some lines if this isn't going to be used in a Modern Dashboard.

    SELECT
    n.AlertObjects.AlertConfigurations.Name AS [ALERT NAME],
    '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(n.AlertObjects.AlertObjectID) AS [_LinkFor_ALERT NAME],
    n.AlertObjects.EntityCaption AS [Node Name],
    n.AlertObjects.Node.IP_Address AS [IP Address],
    n.AlertObjects.AlertActive.Acknowledged AS [Acknowledged],
    n.AlertObjects.EntityDetailsURL AS [_LinkFor_ALERT OBJECT],
    n.AlertObjects.RelatedNodeCaption AS [RELATED NODE],
    n.AlertObjects.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE],
    ToLocal(n.AlertObjects.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
    
    FROM Orion.Nodes as n
    
    WHERE (n.AlertObjects.AlertActive.TriggeredMessage <> '' and n.AlertObjects.AlertConfigurations.Name = 'BOF Display - Node Down')
    ORDER by n.AlertObjects.AlertActive.TriggeredDateTime DESC
    WITH NOLOCK
Reply
  • Hi NoitswithaK,

    Try this SWQL query, I think it'll get you pretty close to where you want to be.  We don't have ServiceNow in our environment, so that's the piece that i cannot help you with.

    BTW, this was written for a Modern Dashboard view, so you may have to remove some lines if this isn't going to be used in a Modern Dashboard.

    SELECT
    n.AlertObjects.AlertConfigurations.Name AS [ALERT NAME],
    '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(n.AlertObjects.AlertObjectID) AS [_LinkFor_ALERT NAME],
    n.AlertObjects.EntityCaption AS [Node Name],
    n.AlertObjects.Node.IP_Address AS [IP Address],
    n.AlertObjects.AlertActive.Acknowledged AS [Acknowledged],
    n.AlertObjects.EntityDetailsURL AS [_LinkFor_ALERT OBJECT],
    n.AlertObjects.RelatedNodeCaption AS [RELATED NODE],
    n.AlertObjects.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE],
    ToLocal(n.AlertObjects.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
    
    FROM Orion.Nodes as n
    
    WHERE (n.AlertObjects.AlertActive.TriggeredMessage <> '' and n.AlertObjects.AlertConfigurations.Name = 'BOF Display - Node Down')
    ORDER by n.AlertObjects.AlertActive.TriggeredDateTime DESC
    WITH NOLOCK
Children
No Data