Hi,
No working knowledge of SWQL at all here - Please can somebody tell me how to filter alerts by severity?
I found SWQL below on Active Alerts with Severity - Custom Queries - The Orion Platform - THWACK (solarwinds.com) but I'd like to filter out "Informational" alerts.
SELECT
o.AlertConfigurations.Name AS [ALERT NAME]
,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]
,o.EntityCaption AS [ALERT OBJECT]
,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]
,o.RelatedNodeCaption AS [RELATED NODE]
,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]
,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE]
,CASE o.AlertConfigurations.Severity
WHEN 0 THEN 'Informational'
WHEN 1 THEN 'Warning'
WHEN 2 THEN 'Critical'
WHEN 3 THEN 'Serious'
WHEN 4 THEN 'Notice'
ELSE CONCAT('Unknown Severity: ', o.AlertConfigurations.Severity)
END AS [Severity]
-- ,N.CustomProperties.NodeRegion
FROM Orion.AlertObjects AS o
LEFT JOIN Orion.Nodes AS N ON N.Caption = o.RelatedNodeCaption
WHERE o.AlertActive.TriggeredMessage <> ''
ORDER by o.AlertActive.TriggeredDateTime DESC