KITGuy

This is what I ended up doing. Thanks.

Thanks Seashore. it works in SWQL Studio but it doesnt seem to work in the SNOW action. I will keep plugging away to see if I can get it to work.

Its not just the databases that go unknown, its the Instance as well that goes unknown. How then do you alert on the availability status of the instance? The Instance status should ignore unknown Db's like DPA ignores unknown AG statuses of secondary replicas. The Dba's are considering giving read access to the monitoring…

Log Analyzer alert variables for syslogs and traps (solarwinds.com) ${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData[1-10]} is the variable although figuring out which varbind is which VbData number I dont know.

Yep looks like it needed temp variables to hold the data. Thanks Seashore