mesverrum · Observability Architect · ✭✭✭✭✭

So the query has 3 nested queries in it, but the outermost query doesn't have anything defining the order, which is what the web UI gets mad about. See the last line here for the fix: ## This code displays only muted nodes in SWQL, however displays no data on the SolarWinds "Custom Query" dashboard widget ##SELECT 'Muted'…

Have you ever seen a windows based vm appliance available for purchase? Because MS licensing makes that a non starter for other companies to sell a self contained windows based appliance.

I don't have swql studio open to confirm but there is a field I think called event type, 0 is a trigger event So something like And eventtype = 0 Should get you there.

If I recall the poller settings are in a registry key, might dig around in regedit and see if you can find it?

You have to be using the custom table widget with a custom SQL or SWQL data source, it's the only SWQL one with an option to tick the box to allow HTML to render correctly. Something like this would work as an example: SELECT case when ComponentStatisticData > 90 then concat('<img…

There's no easy way to set the views back, it's probably more practical to spin up a demo server, check out what they have there and if you see something you are missing go back to your prod system and add the widget in. I'll also say that I personally pretty much throw out 90% of the OOTB content from my environments so…

Npm already runs fine as a vm. If you mean having it available as a fully contained appliance I think that all the Windows dependencies in it basically prevent that. Eventually I could imagine it being available in a container but at this point container tools only support running CLI only on windows core so that's got a…

Nope there is no easier solution, the data in the DB is arranged in the way you see it in your first example and the only way to re-arrange it is with custom SQL.

Would have to come up with something in SQL to join the group to the mute status of the children. Definitely not available in the GUI.

For anyone else who still happens to have this question, I happened to get asked about this again today by @"the_ben_keen" I took the time to test out how to control these properly. In the Orion database under the [CustomPropertyUsage] table there is going to be a list of all your custom properties, and one of the usage…

The forum isn't actually a place to get official support anyway, you just call them up on the phone if you need something. Thwack is intended as users helping users, and I would wager that WHD doesn't have a huge community of users. I know I barely ever touched it even though I worked as a SW consultant for 4 years. One…

This is an example of a report on durations of alerts https://thwack.solarwinds.com/t5/Report-Lab-Discussions/In-need-of-a-report-that-shows-the-span-of-time-when-an-alert-is/m-p/331284

This is it, there's no other magic process https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Install-OrionProducts.htm

The one that doesnt work doesn't seem to have an order by, for some reason the web ui gets fussy when relatively complex queries dont specify the order by. The issue comes up at least once a month.

In the past I've had this problem and my problem was due to case sensitivity issues, if your script doesn't match the exact case that the GUI does then it did this same thing to me. The whole edit/save thing ends up rewriting your definition with their case standards.

You are probably barking up the wrong tree by looking at the last login time if you are trying to do any kind of auditing. Try this SWQL in a custom query SELECT tolocal(TimeLoggedUtc) as [Last Login], AccountID, AuditEventMessage FROM Orion.AuditingEvents ae where daydiff(timeloggedutc,getutcdate())<31 and…

Yep, @"mrxinu" has it. Since you say you are new to SQL a view is functionally pretty similar to a table but it's actually built by combining data from multiple tables with the goal of saving you from having to do all the legwork of joining all those bits together by hand every time you need to do a report. There is a view…

The way we handle this at my company is using custom properties tied to specific alert categories. So for example there is a node custom property for alerts_cpu and our cpu alerts checks to make sure it's not empty. Likewise for alerts_memory, alerts_responsetime, alerts_diskspace, etc. That way the server owners can just…

That's how it works, I always export to Csv, then use the data option in excel to split it into columns and then delete the hash column. Never had a use for that part of it.

Probably just a left join on componentid=componentid and datetime=datetime, but it's friday and I am about done for the week so I can't muster the motivation to test it just now.

Have you tried connecting to the web page from your workstation browser? I know that when I connect to Orion from a server I always get all kinds of warning messages popping up about various security settings being an issue, but workstations aren't hardened to that level so it loads fine from there. For one thing it is…

^ same, the generic examples are too abstract for me to wrap my head around your use case. Post up real code and I can probably tell you what you are running into. If you want to collapse two tables with whatever conditions into a single table I'd most likely just union the two queries, no join needed. If the point is to…

DQ's are defined in the containermembers containermemberdefinition* table. The best way to understand how to build a DQ for inserting directly in is to build an example of what you need and then tweaking in variables. I'll warn you that the GUI gets weird if you insert a DQ definition that is not EXACTLY structured the way…

It's a little indirect, first you make a rule in log analyzer to match your event, and one of the actions available to you is to create an Orion alert when this rule is met, then that takes you to the normal Orion alert UI where you would set up the alert action to send an email.

You can look at a public example I made of a script that builds lots of dynamic groups https://github.com/Mesverrum/MyPublicWork/blob/master/AppAndAppRoleGroupBuilder.ps1

Kiwi and Orion are both not really designed to handle that kind of retention period except in a very small environment, but it is possible with SEM. You're situation may vary but the costs to stand up an appropriately sized SEM instance is potentially in the same ball park as their Splunk server since they are both SIEM…

This method just displays the data from the website, nothing in orion actually reads the content of the feed. I'm sure it would be possible to build some kind of script based SAM monitor to track a feed, but I'm not personally familiar with the twitter API.

Probably need to do it as a custom metric or custom alert, this query could be a starting point https://blog.sqlauthority.com/2009/05/09/sql-server-find-last-date-time-updated-for-any-table/ datediff that value and alert any time it is below 10 or so?

Ah yes that sounds like a real pain. For paralellism we run the threshold at 50, and 0 (unlimited) for maxdop and it seems to work well for what we have. I definitely think the memory optimized being disabled is strange, over the last several releases memory optimized objects are quite significant for Orion. Given a blank…

Have you seen these still sitting around the next day after the database maintenance jobs run? In most of the Orion platform orphaned objects get cleaned up during that around 2:15 AM but I never specifically checked for IP Nodes