smttysmth02gt · ServiceNow Product Owner - ITOM/CMDB/CSDM · ✭✭✭✭✭

Yikes! We currently use the integration for some high level alerts and have not upgraded yet. Thanks for sharing this!

Perhaps. I've never attempted to write any queries using ranges like this on IP addresses. I think you are better off creating a custom property and assigning it to the nodes that you want to be alerted on.

What if you just ran it with IP_Address like '192.168.%'? Would that include more sysname like '%pub%' than you want to be alerted on?

I just ran a test on my network. I tested it on a group of nodes with no wild card whatsoever and it worked perfectly. I inserted the wild card on the same query, on the 3rd octet and it effectively broke the query and 0 results were returned.

Are you testing these in SWQL studio?

You got me then. I've never seen it not work when there's a legitimate IP address that fits the search criteria.................

Right on....sounds like we are all in agreement then. 

You should still be able to pull up results via searching for IP addresses. We almost never leave the node name as just the IP address. 

You should consider installing SWQL for custom report writing. I'm not terribly familiar with using the wizard for writing reports but perhaps if you added a condition where PLATFORM_LOCATION = DBL?

Right, but how can he only look at Cisco devices? The only way he can populate vendor or machine types would be SNMP (AFAIK). 

I would almost say this would be easier if you simply gave these nodes a specific custom property to distinguish them. You could then just create an alert stating "if CP is TRUE" and "Node status is down". Your IP's you're searching for is odd, considering it's the 3rd octet that is the wildcard and not the 4th. 

I'm not following you.....

You could use custom properties and just do where nodescustomproperties.device_type = 'xx'....

Thanks for posting the solution! I always use aliases just because I was taught that way but did not know that it was required.

wluther​ Thanks!

After rereading what you are saying, I do not know of a way to accomplish this. I've put in a request to our SN dev staff a while back for the same type of thing. What I would prefer instead of adding notes to existing tickets, is to have new incidents opened, but have them open as child incidents under the existing active…

Technically "resolved" is still active for 7 days by default, or at least that is my understanding. Yes, that should work fine if your intention is for the alert to create a new incident each time it's triggered. This is the way I have my alerts setup.

The only problem I have run into when auditing things like this is nodes that were never setup for SNMP, and are only polling via ICMP. There is no way to tell what the device is unless you have custom properties or a caption that you can query....sin e the vendor and machine type aren't going to populate. So my work…

To do what I was recommending, you have to write a custom report in SWQL.

Thanks...I have never seen this, nor heard of it as a known issue. 

haha - I meant, background of the pic you posted. We have too many tools right now for projects/work/documentation.

Haha! No. But sometimes I might lift weights during meetings or do some work at another desk. Or sometimes I might be really super tired and if it's not necessary, I won't turn my cam on.

I would recommend you check out network discovery. You can add known (tested) credentials for polling methods you normally use and allow it to test these credentials when it adds the nodes you specify. 

Not to step on roelb's toes, but yes. But that particular setting only shows which nodes have whichever specific setting selected. 

Sorry, I'm not terribly familiar with Python (although I'd like to be one day). Have you tried running a report in SWQL? I don't think I've ever seen a CP that won't work with null, is like, or ''.

I seem to recall having a similar issue a couple of times but ack'ing and clearing the alert fixed it. 

No, I sure haven't. Sorry...I was just trying to be helpful since we're running 12.2. I saw another post someone made about this same issue. Perhaps you might want to create a feature request thread....maybe it'll gain some traction to bring it back. 

Yup....this prevents me from using it on my work system.

nodescustomproperties, not nodes.customproperties?