mesverrum · Observability Architect · ✭✭✭✭✭

Yes this is a query meant to be used in the custom query resource. When you edit the custom query resource the options should look like the screenshot, the first box im referring to us the one titled "custom swql query" then you put a check in the "enable search" and the second block of code goes into the "search swql…

I've been warning people to migrate away from Report Writer since I first started consulting 4 years ago, can't be too big a shock that the want to stop having to support a feature that the replaced in the product that long ago. On the logs topic it is pretty obvious that the direction the wind is blowing is that once they…

You can create much the same effect with custom SWQL queries, see this post for the down nodes resources Re: How long each interface or node was down. -Marc Netterfield Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems *

The AWS just communicates with the active server. During a failover you might not be able to load pages for 30 seconds or so during the cutover, but once the secondary finishes coming up the DB entries all get updated and the AWS will be good again and you won't really notice any other impact. Given how cheap the licenses…

Tools generally like that have definitely been built, I know zackm had built a little powershell front end for bulk unmanage jobs for someone years ago to keep their admins from having to muck around in Orion to make those changes. I've built lots of tools to facilitate self service for teams where we were able to embed…

I've used this bit, for example, to sync up alerts between instances. Pretty painless. # get Alert IDs for enabled alerts $AlertIDs = Get-SwisData -SwisConnection $swissource -Query "SELECT AlertID FROM Orion.AlertConfigurations WHERE Enabled = 'true' and name not like '%syslog%'" # migrate the alerts foreach ($AlertID in…

To make things more secure one trick you can do is to change line 26 like so $swis = Connect-Swis -Hostname my-orion-host.domain.com -Username alertbackup -Password My_Bogu$_P@55w01d becomes $swis = Connect-Swis -Hostname my-orion-host.domain.com -Trusted Then you just set up your scheduled task to run under any Windows…

You are right, it's obviously too late in the evening for me today. Good eye

Change the where line like this to remove acknowledged alerts. WHERE o.AlertActive.TriggeredMessage <> '' and o.alertactive.acknowledged is not null

Nadie ha hecho que esto funcione para 12.0+, en su lugar puede usar esto en el recurso "Custom Query". Perdona mi mal español SELECT tolocal(EventTime) as [Event Time] , Message ,'/Orion/View.aspx?NetObject=' + netobjecttype + ':' + tostring(netobjectid) as [_linkfor_Message]…

Also, to answer your more specific question about using this on a node details page, I would just add to the where condition like so where daydiff(e.EventTime,getutcdate())<7 and e.netobjectid = ${nodeid} and e.netobjecttype = 'n'

So I think we just ran into some kind of weird display bug. I loaded the query up onto my lab and got similar results as you describe, lots of group events, a handful of random other ones and tons of missing events. When I ran the exact same query in SWQL studio everything works as expected. Spent some time poking at it to…

****Edit: don't use this version of the query, see the replies below regarding how filtering to top 25 gives unexpected errors in results**** Here is a swql version, i think its a lot easier to manage than adding custom resources that may or may not work in future releases. SELECT top 25 EventTime , Message…

Should need any changes to run in 12.4, I have it running on my lab right now. It is written to be used inside the Custom Query resource though, not as a Custom Table

Don't run it in the database, this is written to be used inside a resource in the web console called "Custom Query"

Check this post, Top 50 CPU growth - last 30 days

This is an old report writer based report, so IIRC you just unzip this file into \Program Files (x86)\SolarWinds\Orion\Reports and it should show up (don't remember fi you have to restart the services or anything

Ugh I don't know how I missed it when you were asking for feedback yesterday. A search button!

About a year ago I started figuring that the next big thing in Orion dashboards and such was just going to be custom rolling javascript with data with pull from the API, and that I need to get proficient in JS. Of course I never made any time for that but here you are blazing the trail, good job. I suspect this is going to…

I typically build them out for a handful of use cases, places with lots of remote locations where we want to either have a physical floor plan of IDF closets and network infrastructure or a logical network topology diagram. Another common use case is to take the architectural diagram I have for any given piece of software…

Ill double check later but I think this should work to do that with pretty simple changes.

Every problem most people run into as a solarwinds owner is a one time nuisance, for me its a nuisance I see again and again each week with each new client. Repetitive tasks are jobs for computers, not me.

Could be an Avaya network? I'd seen similar results using Connect Now in atlas with one in the past due to the way they report their connections between devices with their fancy meshes.

If the device is still down it should be using getutcdate(), maybe try just getdate(). Are you in the utc-5 time zone? Another factor to keep an eye would be if you have multiple pollers make sure they are all using the same timezone because of all the documented weirdness that Orion gets when your pollers are not in the…

I believe it could as long as there is an eventid for bgp neighbors going up and down, but I don't have any neighbors on any of my lab devices so I don't have anything to work with to figure it out right now.

From what I've seen it looks like this query only works in the 2018 and newer versions of the core, older versions of SWQL don't like my extra layers of nested subqueries

I happened to set this up with my client this week and it won't run for them using NPM 12.2, so its possible that this would require 12.3, I'll pin down the version and update the post.

Do you have SWQL studio installed? Try it there and you tend to get much more detailed error messages. Troubleshooting it through the web UI is rarely productive. https://github.com/solarwinds/OrionSDK/releases

I'm running the latest release, can't see anything that jumps out to me as requiring a specific version, which one are you running?

Event history is only kept for 30 days if you have the default retention settings