marcrobinson · Observability Detective · ✭✭✭✭✭

(+) Enabled Alert Query Details - Reports - The Orion Platform - THWACK (solarwinds.com) Check this report out. I think this is the one I was looking for. I believe some of the actions were added to it. 

hmmm i dont see a where clause to look for only enabled alerts. Try this: SELECT oa.ActionID, oa.ActionTypeID, oa.Title, oa.Description, oa.Enabled, ac.DisplayName as AlertName, ac.Enabled as IsAlertEnabled FROM Orion.Actions oa JOIN ORION.ActionsAssignments aa on oa.ActionID = aa.ActionID JOIN Orion.AlertConfigurations ac…

I am assuming that the AS statement was not in the one of queries. If you have the same field from different entities in a query they will show up as Enabled, Enabled1. Try the following, enabled is reported on from two separate entities. SELECT oa.Enabled, ac.EnabledFROM Orion.Actions oa JOIN ORION.ActionsAssignments aa…

Eventually, but they are supposed to be compatible with the solarwinds platform. The licensing is still separate from HCO. 

WMI for NPM/SAM/server metrics. WinRM for SAM application monitoring. I wish they would swap WinRM in for WMI overall, but I believe there are some pain points to that approach. Use WinRM for application monitor polling in SAM (solarwinds.com) you can create a least privileged account to use for WMI polling. It can be…

You would be looking at the new Modern Dashboards with the KPI widgets. Some starting points, the long thread on changing colors is worth looking at. Do NOT forgot to set the modern dashboard to PUBLIC as private is the default option. It is rather annoying. Modern Dashboards - The Orion Platform - THWACK (solarwinds.com)…

I was just looking at IPAM events that are logged by default - I do not see an event for IPAM update failures. It might show up in the poller's windows event logs, or more likely the IPAM server logs - default location is something like: C:\ProgramData\SolarWinds\Logs\IPAM\* Preventing the users from doing something that…

Please try it in SWQL Studio (make sure you have the latest version) and see if it fails again. I dont see anything wrong with this. I am also not on 2022.3

this is not everything you wanted but it is what I found. I know that someone else posted a report this year that broke down the xml file with even more details. All Configured Alerts Inventory Report - Reports - The Orion Platform - THWACK (solarwinds.com) Here is a quick swql to grab actions and link them to alerts in…

https://documentation.solarwinds.com/en/success_center/sam/content/sam-api-poller-troubleshoot.htm This page has a lot of troubleshooting information, including log locations. 

Why two sections? This worked for me. I substituted your custom property for one of my one, and it worked just fine. I pasted my version below with your custom property. I use similar type of capacity alert for disk space. SELECT NodesForecastCapacity.Uri , NodesForecastCapacity.DisplayName FROM Orion.NodesForecastCapacity…

Ditto to what Fred and KMSigma said. Keep your system behind the corp firewall, and the hybrid cloud is really the next generation of the Orion platform with different licensing. There is a bit more to it, but that is the short version. 

This is still an issue with the NCM entities in SWQL Studio. 2020.2.6 HF5. i have not run into this with the other entities if I do not specify my username in domain/username format. Still - good to know, and I will probably forget this in the future... At least I can search for the answer and get it again. 

Not that I know of, but THE MOST AWESOME IDEA, beyond Dark Theme for the SolarWinds Orion platform itself. This needs to be a feature request. 

Thanks for the heads up. I will re-read the notes about those extra dbs. I dont use log analyzer, so that will be the new one. I glanced at the readme files, and realized that 'all' modules are there; waiting to be tested or licensed. I didnt think about creating new databases or catch any notes about them. GAH! There were…

You are looking into IIS logs for that information. 

If you are using SWQL, they are in the entities Orion.NPM.CustomPollerStatistics and Orion.NPM.CustomPollers, among a few others, that all begin Orion.NPM.CustomPoller... 

If you are asking if the "I want to alert on: Component" means that you are creating a component based alert? The answer is yes that is correct. When you change the drop down for the "I want to alert on" option, not only does it change the scope of the alert and actual trigger condition, but it will also affect the email…

I tend to agree with @"donrobert5" . IPAM is designed as a discovery tool as much as another else. Let it talk to the new DHCP servers and repopulate any data. I would consider deleting any scopes that are still empty or unused/unloved after a week of new successful scans. 

Good question. Using the custom html widget in a classic dashboard will allow you to set up an iframe and load the modern dashboard- but you would get twice the menu bars/headers.. Other than popping them in an external window via the user links widget (as you mentioned ), this is a tough one. I don't get twice the headers…

Please do not ignore joins. I have noticed behavioral differences when using the implicit joins, and sometimes, when you want the implicit join, it does not exist and you need to create it. Its more of test and see which works better for your scenario. Swql Studio is your best friend when writing them. 

Please consider adding me in. 

I did something similar, but I set it to look at the interface first then check for no traffic. I am pretty sure I borrowed some of this from another post when I was working on it. You might find more in thwack if you keep searching. I will paste it below as a starting point, hopefully it helps.I created this a custom swql…

You were missing the parenthesis on the second query. (Select blah blah...) . I ran it but did not return much from the second query. Something is off with that entity - could just be me. But you may not need a union statement as a join seems to work. see below. SELECT n.NodeID, n.Caption, n.HardwareHealthInfos.ServiceTag,…

Has anyone submitted a feature request to make this simpler? It just seems like an obvious need, since we are moving towards the Modern Dashboards like a large ship in the Atlantic. We can only avoid so many icebergs. OK, the Modern Dashboards are NOT icebergs, but seriously, I will be creating LOTS of these pie charts.…

SolarWinds API should support OAUTH2 and Bearer Token, and not just basic auth. - Feature Requests - The Orion Platform - THWACK - SolarWinds Community submitted 

I agree with bobmarley, with the following two warnings. Having a user in more than one windows group is still a bad idea. I have seen things still get wonky for that person after they login. It is best to avoid that mess. Second, if you have account limitations setup - that could block them from interacting with nodes…

Have you checked the netflow template that the device is using? NetFlow v9 Datagram Knowledge Series: Part 3 - NetFlow v9 Template FlowSet - Geek Speak - Resources - THWACK - SolarWinds Community This is an old post but it has some good information about flow and flow templates.

If you access the source setup section in your loggly web console, you will see lots of information about how to configure sources. You will need to configure your token too. Here is the general link to help docs about source setup. I dont see an exact config for winlogbeat, but there is enough here to get you started. 

The unmanaged nodes will stay unmanaged - only if you set a schedule and it expired will it change on its own. I generally have not seen a flood of alerts after upgrading - but I this may not be true for everyone, including you.