Comments
-
Circled back around quite a ways, haha. But actually you were right, this was pretty spot on to what I needed. The only issue I'm having right now is I'm not seeing any alert that's currently active. I did some modifications to your query to catch only alerts that were active for more than 15 minutes without being…
-
Hey, yeah, that's pretty close. I ended up finding a query in this forum, I think actually from you, that was even closer. I think our idea is to eventually get a report of alerts that are active for more than 15 minutes and that were not acknowledged. So I know there's plenty of reports out there that show…
-
Got 'er. No SWQL/SQL needed. I created an alert to alert on a specific node - I picked ORION (127.0.0.1. So it's pointing at itself.) and for the trigger condition I set as 'Node Name = ORION' which will always be true. Then I used time of day to set for whatever day I want to be alerted. Works like a charm.
-
Hot dang, just what I was lookin' for.
-
So I've seen the time feature, but it's the trigger condition that I need to get figured. I just need some way to say "trigger condition = true." and then set the alert to only be active for that one day.
-
As it turns out, that syntax was valid, and wasn't what was causing my erratic results. What I was failing to do was specify 'tolocal' for both the weekday function as well as the Hour function. Like this: ... --MONDAY or (( ah.eventtype=0 and weekday(tolocal(ah.timestamp)) = 1 and Hour(tolocal(ah.timestamp)) < 19 )) or ((…
