mesverrum · Observability Architect · ✭✭✭✭✭

I'm not following what you are trying to do, use joins instead of where conditions? I think what you are trying to do is probably best done this way: select n.dns from orion.nodes n where n.customproperties.nyt_patch_schedule = '9999NR'

There are some specific limitations in SWQL but if you post the full query there is usually a work around. The only thing I have to revert to plain SQL for these days is window functions.

Sam SMP components dont support get-tree or OIDS with strings instead of numbers. Probably going to be pretty hard to get what you need.

Your assumption is incorrect, directlink is kind of a specific use case for providing access to people so they don't have to pass in creds, which is pretty much in conflict with the idea of SSO automatically passing in creds. Any time I have seen people try to use both features at once it becomes a headache. Pretty much…

Yep the widgets don't show the parent lineage, needs to be fixed.

Just at a glance i see you are joining on the datetimes of the polls for two different interfaces. That's probably never going to happen. The timestamps are down to millisecond scale and will not match. Not entirely sure where you plan to go with this SQL but I'd most likely be doing something like this instead of all the…

Never heard of that application, but if you figure it out you can integrate Orion with basically anything.

In the last couple releases there was an out of the box alert a name like node polling error or similar that does just that.

Whenever I can't find a verb in SWIS I always fall back to leveraging the execute sql verb under Orion.Reporting to make my changes directly, but be careful making edits like that if you try it.

So in many cases if the swql "table" doesn't directly map to a real SQL table they won't allow set SWIS object on it, but if you dig around you can usually find a different area where the changes are allowed. I don't have the new version installed yet but I'd go to swql studio and just search threshold, or warning, or…

Can't remember off the top of my head how to fix it in splunk but it looks like you have splunk pulling the value and summing it instead of treating it as a replacement value.

From when I was consulting I'd say the majority of people who use SAM use WMI, it allows a lot of additional data to be collected. They both work fine. WinRM polling was recently added in the latest release and they say that's supposed to be much more efficient and easier for firewall rules.

Yes you can use the same variables as any other node alert.

I've had to do that in many environments where we had direct internet access cut off. I remember it helped my page load times but I also made several other changes at the same time.

Or are you saying that you upgraded your orion to 2016 and now the nodes that were already in with snmpv3 can no longer poll? Did you migrate to a new server as part of that rebuild? I suspect the new server can no longer decrypt the credentials that were in the database under the old system and you will need to re-enter…

Not at my desk but given the reports you say you have it would be like select some columns from Orion nodes left join orion.assetinventory.software on nodes.nodeid=software.nodeid and software.name = 'yoursoftware' -- this column is case sensitive, careful where software.name is null

Not yet, just get the OOTB default map from the node details

What do you consider real? Polling the OS will get you what the OS thinks it uses, polling the host/vcenter will give you what resources the VM is actually consuming on the host after things like memory page dedupe and other virtualization technologies reduce the load. "Real" means different things to different people.

Orion does all the alert logic using ms sql, which doesn't exactly have a regex engine but it has a like operator and some functions that can usually accomplish the most typical examples of string parsing. So for the alert condition you probably will want to do a custom sql condition for interfaces where…

You could definitely do that in Orion, as long as you have enough licenses. You probably will want to set up the logic in your alerts not to be constantly blowing yourself up with messages about end users rebooting their machines or shutting them down at the end of the day or whatever. I think the point where it becomes…

Those fall under what SW calls Hardware Health Monitoring, and generally speaking as long as you have the agent for your server type installed they can be monitored through the OS of your server. So for Dell the agent is openmanage, HP has Insight. For some of the less standard brands you can also add in the out of band…

*15 min default

As an infrastructure monitoring tool SW isn't really set up to function as as that kind of reporting/analytics for AD. Everything in Orion is based on periodically polling and storing results as number based metrics but that login stuff is event data and extracted fields. Do you have a SIEM? This data would be standard for…

Technically you can do it without scripts and such by making an alert action to set the property.

Scm or sam could probably both do this but in both cases I expect it would be using a powershell script to get-childitems from the folder

Most companies don't monitor workstations with Orion, but there's not a technical limitation as much as it's an administrative and process hassle. What on a end user system do you have a responsibility to proactively address?

Could you not just use a regex match for any line with just logging host 192.168. and do a second rule for the 10.168?

Select distinct works the same in custom reports as it does anywhere else, I use it often. Any chance you could post the query and we can find a reason it's behaving oddly?

https://documentation.solarwinds.com/en/Success_Center/NCM/Content/NCM-Command-Template-Commands.htm You'll be looking for the section on precommands

Honestly for use cases like this I've always just wrote myself a script in powershell to create separate components for each vdi name. I would do something like my base template only contains a single component with the script set up to filter using the vdi name as an argument and tell it to pull the 4 values back as…