cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Muted Nodes Resource

Muting of Nodes, Interfaces, and Applications is a great option added to Orion, but I've noticed that there wasn't an easy way to see these in a report.  With that in mind, I added a custom report in my environment.  There are three total variations of the report - for those running Network Performance Monitor, Server & Application, or both.

You can also easily see muted elements from the new Managed Entities view, but I want them quicker.

New_Managed_Entities.png

Managed Entities is restricted to pseudo-admins, and some of my users don't have access to that page, nor do I want them to have access.  They could run the report, I don't always want them to run a report when they need a list of elements that are muted.

Since the report is based around SWQL, I can leverage the same to build a custom query resource on the Enterprise Dashboard.

For those new to the suite, I wanted to give you the step-by-step skinny on how I did this.

Start by clicking on the pencil icon on the top-left of the page to Customize the page.

Customize_Page.png

Next, we've got to add a new widget.

Add_Widget.png

Search in the Available Widgets for the Custom Query.

Find_Widget.png

Now drag that Widget to a new location on your page.

Drag_Widget.gif

In the Add Widgets bar, click "Done Adding Widgets."

Done_Adding_Widgets.png

In the Customize Page bar, click on "Done Editing."

Done_Customizing.png

The current resource is empty, now let's edit it.

Edit_Resource.png

Here's the meat and potatoes for the widget.

Meat_and_Potatoes.png

These are the settings that I'm using:

Title: Muted Alerts

Subtitle: Current or Scheduled Muted Alerts

Custom SWQL Query:

SELECT DISTINCT
       CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[Caption]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[FullName]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[FullyQualifiedName]
          ELSE 'SomethingElse'
       END AS [Element],
       CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[DetailsUrl]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[DetailsUrl]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[DetailsUrl]
          ELSE 'SomethingElse'
       END AS [_LinkFor_Element],
       [AE].AccountID AS [By],
       ToLocal([SuppressFrom]) AS [Start],      
       ToLocal([SuppressUntil]) AS [End]
FROM Orion.AlertSuppression AS [AlertSup]
LEFT OUTER JOIN Orion.Nodes AS [N]
   ON [AlertSup].[EntityUri] = [N].[Uri]
LEFT OUTER JOIN Orion.NPM.Interfaces AS [I]
   ON [AlertSup].[EntityUri] = [I].[Uri]
LEFT OUTER JOIN Orion.APM.Application AS [AA]
   ON [AlertSup].[EntityUri] = [AA].[Uri]
LEFT OUTER JOIN Orion.AuditingEvents AS [AE]
   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[NodeName]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[InterfaceCaption]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[Name]
          ELSE 'Wrong'
       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID)
INNER JOIN Orion.AuditingActionTypes AS [AT]
   ON [AE].ActionTypeID = [AT].ActionTypeID
WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )
ORDER BY [SuppressFrom]

Search SQWL Query:

SELECT DISTINCT
       CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[Caption]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[FullName]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[FullyQualifiedName]
          ELSE 'SomethingElse'
       END AS [Element],
       CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[DetailsUrl]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[DetailsUrl]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[DetailsUrl]
          ELSE 'SomethingElse'
       END AS [_LinkFor_Element],
       [AE].AccountID AS [By],
       ToLocal([SuppressFrom]) AS [Start],
       ToLocal([SuppressUntil]) AS [End]
FROM Orion.AlertSuppression AS [AlertSup]
LEFT OUTER JOIN Orion.Nodes AS [N]
   ON [AlertSup].[EntityUri] = [N].[Uri]
LEFT OUTER JOIN Orion.NPM.Interfaces AS [I]
   ON [AlertSup].[EntityUri] = [I].[Uri]
LEFT OUTER JOIN Orion.APM.Application AS [AA]
   ON [AlertSup].[EntityUri] = [AA].[Uri]
LEFT OUTER JOIN Orion.AuditingEvents AS [AE]
   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
             THEN [N].[NodeName]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
             THEN [I].[InterfaceCaption]
          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
             THEN [AA].[Name]
          ELSE 'Wrong'
       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID)
INNER JOIN Orion.AuditingActionTypes AS [AT]
   ON [AE].ActionTypeID = [AT].ActionTypeID
WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )
  AND CASE
         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
            THEN [N].[Caption]
         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
            THEN [I].[FullName]
         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
            THEN [AA].[FullyQualifiedName]
         ELSE 'SomethingElse'
      END LIKE '%${SEARCH_STRING}%'
ORDER BY ToLocal([SuppressFrom])

Number Of Rows Per Page: 5 (choose this number as you like)

Submit the changes and you are set.

Muted_Alerts_Resource.png

Now you have quick access to all the elements that you have muted... oh and you get to see who requested the alerts being muted.

Labels (1)
Tags (1)
Comments

Hi,

How can we see the muted nodes either vendor wise or EffectiveCategory =1?

I need a little more clarification.  What exactly are you looking to see?

Hi ,

Thank you for the quick response.

I want to see only  muted network device (EffectiveCategory =1). Or if there is options like we can filter Network nodes, Server nodes, Unix nodes as muted.

I have gone through through above SQL query that is very good but there is all vendor nodes are showing in same queue.

Thanks.

Maybe I'm just lost, but I don't see "EffectiveCategory" as any type of variable to use to key off of.

Hello KMSigma,

Here "EffectiveCategory =1?" is related to Network nodes nothing else. So, I need SQL query option through which we can see the muted nodes of the networking device only.

pastedImage_0.png

Change the WHERE Clause to be this:

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )

   AND [N].Category = 1

Hello KMSigma,

Excellent !, thank you, working for me.

Hi KMSigma, It is not working on real-time.  There are no longer muted, but show up on my team page.

pastedImage_0.png

Hello KMSigma, Can you suggest where can we use Catogery=1 in below query? As I checked above query is not working on real-time.

select n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

select

n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

where n.caption like '%${SEARCH_STRING}%'

Hello KMSigma,

It is not working on real-time, can you please check it once. It is not updated since 8th May 2018.

pastedImage_0.png

I am using below SWQL query:

Custom SWQL Query:

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start],        

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )

AND [N].Category = 1

ORDER BY [SuppressFrom] 

-------------------------------------------------------------------------------------------------

Search SWQL Query:

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start], 

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' ) 

AND [N].Category = 1

  AND CASE 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

            THEN [N].[Caption] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

            THEN [I].[FullName] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

            THEN [AA].[FullyQualifiedName] 

         ELSE 'SomethingElse' 

      END LIKE '%${SEARCH_STRING}%' 

ORDER BY ToLocal([SuppressFrom])

Hi

Did you get the chance to check it once? It doesn't work on real-time. We have created this dashboard on 28th May and that date is still showing. when I do mute any nodes its doesn't show today's date.

pastedImage_0.png

Can you go into the SWQL studio and provide the results from your query and post them to this page?

Hi KMSigma, I am sorry but we don't have MSSMS (SWQL Studio) in our environment. Do you have any other options to check the same?

This is awesome, thank you.

Hi KM Sigma,

We also use one more SWQL query for the mute state. Can we add 2 things in below query?

[1] Catogery=1

[2] BY - who has kept on mute.

[3] It works on real time.

----------------------------------------------------------------------

CUSTOM SWQL QUERY

select n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

-----------------------------------------------------------------------------

SEARCH SWQL QUERY

select

n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

where n.caption like '%${SEARCH_STRING}%'

It's not the SQL Server Management Studio (SMSS), it's the SWQL Studio (SolarWinds Query Language Studio) which is available from Releases · solarwinds/OrionSDK · GitHub  .  Just download the MSI, install it on one of your client machines, connect it to your Orion server and go.

I've also made a few tweaks to this query.  This time using UNIONs instead of all the CASE statements.  This doesn't include who set the element up as muted, but it may be helpful for many people.

------------------
-- Custom Query --
------------------

SELECT [N].Caption as [Element]
     , [N].DetailsURL as [_LinkFor_Element]
     , '/Orion/images/StatusIcons/Small-' + [N].StatusIcon AS [_IconFor_Element]
     -- , [N].IP_Address as [IP]
     -- , [N].DetailsURL as [_LinkFor_IP]
     , [Alerts].SuppressFrom as [Mute From]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.Nodes AS [N]
  ON [N].Uri = [Alerts].EntityURI

UNION

( SELECT [I].FullName as [Element]
     , [I].DetailsURL as [_LinkFor_Element]
     , '/Orion/images/StatusIcons/Small-' + [I].StatusIcon AS [_IconFor_Element]
     -- , [I].IP_Address as [IP]
     -- , [I].DetailsURL as [_LinkFor_IP]
     , [Alerts].SuppressFrom as [Mute from]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.NPM.Interfaces AS [I]
  ON [I].Uri = [Alerts].EntityURI

)

UNION

(
SELECT [A].FullyQualifiedName AS [Element]
     , [A].DetailsUrl AS [_LinkFor_Element]
     , '/Orion/APM/images/StatusIcons/Small-App-' + [A].StatusDescription + '.gif' AS [_IconFor_Element] 
     , [Alerts].SuppressFrom as [Mute From]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.APM.Application AS [A]
  ON [A].Uri = [Alerts].EntityURI
)


------------------
-- Search Query --
------------------

SELECT [N].Caption as [Element]
     , [N].DetailsURL as [_LinkFor_Element]
     , '/Orion/images/StatusIcons/Small-' + [N].StatusIcon AS [_IconFor_Element]
     -- , [N].IP_Address as [IP]
     -- , [N].DetailsURL as [_LinkFor_IP]
     , [Alerts].SuppressFrom as [Mute From]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.Nodes AS [N]
  ON [N].Uri = [Alerts].EntityURI

WHERE [Element] LIKE '%${SEARCH_STRING}%'

UNION

( SELECT [I].FullName as [Element]
     , [I].DetailsURL as [_LinkFor_Element]
     , '/Orion/images/StatusIcons/Small-' + [I].StatusIcon AS [_IconFor_Element]
     -- , [I].IP_Address as [IP]
     -- , [I].DetailsURL as [_LinkFor_IP]
     , [Alerts].SuppressFrom as [Mute from]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.NPM.Interfaces AS [I]
  ON [I].Uri = [Alerts].EntityURI

WHERE [Element] LIKE '%${SEARCH_STRING}%'
)

UNION

(
SELECT [A].FullyQualifiedName AS [Element]
     , [A].DetailsUrl AS [_LinkFor_Element]
     , '/Orion/APM/images/StatusIcons/Small-App-' + [A].StatusDescription + '.gif' AS [_IconFor_Element] 
     , [Alerts].SuppressFrom as [Mute From]
     , [Alerts].SuppressUntil as [Mute Until]
FROM Orion.AlertSuppression AS [Alerts]
JOIN Orion.APM.Application AS [A]
  ON [A].Uri = [Alerts].EntityURI

WHERE [Element] LIKE '%${SEARCH_STRING}%'
)

Your mileage may vary.

Hi KMSigma, Thank you for the prompt response. Actually, we want to capture the Network category devices only and given query is sending out for all category (Like Linux, Solaris, VMware...etc)

Hi, I have tested the query which you have shared on Jun 6, 2018, 10:47 AM.  That was successfully executing but it was not working on real time. ------------------------------------------------------------- Shared script date and timing: shaim vansh Jun 6, 2018 10:47 AM (in response to shaim vansh)

When I run below query the start date doesn't change. it is showing 28th May 2018.

pastedImage_0.png

Custom SWQL Query:

  1. SELECTDISTINCT
  2. CASE
  3. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  4. THEN [N].[Caption] 
  5. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  6. THEN [I].[FullName] 
  7. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  8. THEN [AA].[FullyQualifiedName] 
  9. ELSE'SomethingElse'
  10. ENDAS [Element], 
  11. CASE
  12. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  13. THEN [N].[DetailsUrl] 
  14. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  15. THEN [I].[DetailsUrl] 
  16. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  17. THEN [AA].[DetailsUrl] 
  18. ELSE'SomethingElse'
  19. ENDAS [_LinkFor_Element], 
  20.        [AE].AccountID AS [By], 
  21.        ToLocal([SuppressFrom]) AS [Start],        
  22.        ToLocal([SuppressUntil]) AS [End
  23. FROM Orion.AlertSuppression AS [AlertSup] 
  24. LEFTOUTERJOIN Orion.Nodes AS [N] 
  25. ON [AlertSup].[EntityUri] = [N].[Uri] 
  26. LEFTOUTERJOIN Orion.NPM.Interfaces AS [I] 
  27. ON [AlertSup].[EntityUri] = [I].[Uri] 
  28. LEFTOUTERJOIN Orion.APM.Application AS [AA] 
  29. ON [AlertSup].[EntityUri] = [AA].[Uri] 
  30. LEFTOUTERJOIN Orion.AuditingEvents AS [AE] 
  31. ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
  32. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  33. THEN [N].[NodeName] 
  34. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  35. THEN [I].[InterfaceCaption] 
  36. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  37. THEN [AA].[Name
  38. ELSE'Wrong'
  39. END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 
  40. INNERJOIN Orion.AuditingActionTypes AS [AT
  41. ON [AE].ActionTypeID = [AT].ActionTypeID 
  42. WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged'
  43. AND [N].Category = 1
  44. ORDERBY [SuppressFrom] 

Search SQWL Query:

  1. SELECTDISTINCT
  2. CASE
  3. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  4. THEN [N].[Caption] 
  5. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  6. THEN [I].[FullName] 
  7. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  8. THEN [AA].[FullyQualifiedName] 
  9. ELSE'SomethingElse'
  10. ENDAS [Element], 
  11. CASE
  12. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  13. THEN [N].[DetailsUrl] 
  14. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  15. THEN [I].[DetailsUrl] 
  16. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  17. THEN [AA].[DetailsUrl] 
  18. ELSE'SomethingElse'
  19. ENDAS [_LinkFor_Element], 
  20.        [AE].AccountID AS [By], 
  21.        ToLocal([SuppressFrom]) AS [Start], 
  22.        ToLocal([SuppressUntil]) AS [End
  23. FROM Orion.AlertSuppression AS [AlertSup] 
  24. LEFTOUTERJOIN Orion.Nodes AS [N] 
  25. ON [AlertSup].[EntityUri] = [N].[Uri] 
  26. LEFTOUTERJOIN Orion.NPM.Interfaces AS [I] 
  27. ON [AlertSup].[EntityUri] = [I].[Uri] 
  28. LEFTOUTERJOIN Orion.APM.Application AS [AA] 
  29. ON [AlertSup].[EntityUri] = [AA].[Uri] 
  30. LEFTOUTERJOIN Orion.AuditingEvents AS [AE] 
  31. ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
  32. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  33. THEN [N].[NodeName] 
  34. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  35. THEN [I].[InterfaceCaption] 
  36. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  37. THEN [AA].[Name
  38. ELSE'Wrong'
  39. END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 
  40. INNERJOIN Orion.AuditingActionTypes AS [AT
  41. ON [AE].ActionTypeID = [AT].ActionTypeID 
  42. WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged'
  43. AND [N].Category = 1
  44. ANDCASE
  45. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
  46. THEN [N].[Caption] 
  47. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
  48. THEN [I].[FullName] 
  49. WHEN [EntityUri] LIKE'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
  50. THEN [AA].[FullyQualifiedName] 
  51. ELSE'SomethingElse'
  52. ENDLIKE'%${SEARCH_STRING}%'
  53. ORDERBY ToLocal([SuppressFrom]) 

Then all you need is the first part of the query (before the first UNION) and add a WHERE clause.

SELECT [N].Caption as [Element]

     , [N].DetailsURL as [_LinkFor_Element]

     , '/Orion/images/StatusIcons/Small-' + [N].StatusIcon AS [_IconFor_Element]

     -- , [N].IP_Address as [IP]

     -- , [N].DetailsURL as [_LinkFor_IP]

     , [Alerts].SuppressFrom as [Mute From]

     , [Alerts].SuppressUntil as [Mute Until]

FROM Orion.AlertSuppression AS [Alerts]

JOIN Orion.Nodes AS [N]

  ON [N].Uri = [Alerts].EntityURI

WHERE [N].Category = 1

Hi KMSigma, No, it's not working for Network (Category = 1) Can you please check it once my second last post? shaim vansh Jun 19, 2018 10:02 PM (in response to shaim vansh)

I don't know what to tell you, because it works for me.

THWACK_MutedNetworkDevices.png

Running:

  • Orion Platform 2018.2.1 SP1
  • NPM 12.3

Note that this shorter query does NOT include ​who​ flipped the device to a muted status.

Hi KMSigma, Of course, it was working for but I was getting all vendors nodes mute states. while  I am looking for Network domain nodes.

Hi KMSigma,

Thank you for your prompt response.!

I wanted to tell you that created 'muted node dashboard' (for Network devices only "AND [N].Category = 1") is not updating. I have created this dashboard on 28th May 2018 but still, same time is showing over there.

pastedImage_0.png

I am using below SWQL Query:

-----------------------------------------------------

Custom SWQL Query:

------------------------------------

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start], 

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' ) 

AND [N].Category = 1

  AND CASE 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

            THEN [N].[Caption] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

            THEN [I].[FullName] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

            THEN [AA].[FullyQualifiedName] 

         ELSE 'SomethingElse' 

      END LIKE '%${SEARCH_STRING}%' 

ORDER BY ToLocal([SuppressFrom])

-----------------------------------------------

Search SWQL Query:

--------------------------------------------

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start],        

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )

AND [N].Category = 1

ORDER BY [SuppressFrom] 

Hello

Any idea why I am getting There was an error processing the request.

When using the following on NPM 12.3 and I don't have the Application module.

I am using below SWQL Query:

-----------------------------------------------------

Custom SWQL Query:

------------------------------------

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start], 

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' ) 

AND [N].Category = 1

  AND CASE 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

            THEN [N].[Caption] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

            THEN [I].[FullName] 

         WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

            THEN [AA].[FullyQualifiedName] 

         ELSE 'SomethingElse' 

      END LIKE '%${SEARCH_STRING}%' 

ORDER BY ToLocal([SuppressFrom])

-----------------------------------------------

Search SWQL Query:

--------------------------------------------

SELECT DISTINCT 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[Caption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[FullName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[FullyQualifiedName] 

          ELSE 'SomethingElse' 

       END AS [Element], 

       CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[DetailsUrl] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[DetailsUrl] 

          ELSE 'SomethingElse' 

       END AS [_LinkFor_Element], 

       [AE].AccountID AS [By], 

       ToLocal([SuppressFrom]) AS [Start],        

       ToLocal([SuppressUntil]) AS [End] 

FROM Orion.AlertSuppression AS [AlertSup] 

LEFT OUTER JOIN Orion.Nodes AS [N] 

   ON [AlertSup].[EntityUri] = [N].[Uri] 

LEFT OUTER JOIN Orion.NPM.Interfaces AS [I] 

   ON [AlertSup].[EntityUri] = [I].[Uri] 

LEFT OUTER JOIN Orion.APM.Application AS [AA] 

   ON [AlertSup].[EntityUri] = [AA].[Uri] 

LEFT OUTER JOIN Orion.AuditingEvents AS [AE] 

   ON [AE].AuditEventMessage LIKE CONCAT('%', CASE 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' 

             THEN [N].[NodeName] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%' 

             THEN [I].[InterfaceCaption] 

          WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%' 

             THEN [AA].[Name] 

          ELSE 'Wrong' 

       END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID) 

INNER JOIN Orion.AuditingActionTypes AS [AT] 

   ON [AE].ActionTypeID = [AT].ActionTypeID 

WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )

AND [N].Category = 1

ORDER BY [SuppressFrom] 

thanks

Ken

Nice KMSigma! Definitely adding this in today... I already use the report for muted nodes v5 you made. Seriously muted alerts is an awesome feature but very easily forgotten about. Fine work good sir.

You'll need to comment out any references to the SAM components:

  • Applications
  • ApplicationID
  • Orion.APM.Application
  • AA

You can look at Current Muted Alerts for Network Devices (v5) [NPM Only]  as a reference for some of the syntax.

trying this query as a resource and getting

There was an error processing the request.

I had an earlier query, but it was still showing nodes that were no longer muted but would show -3 days from when they were unmuted. 

When I try the query in SWQL Studio I get this error:

Order BY items must appear in the select list if SELECT DISTINCT is specified.

What are the results of this query?

SELECT CASE
          WHEN Name = 'APM'     THEN 'Server & Application Monitor'
          WHEN Name = 'IPAM'    THEN 'IP Address Manager'
          WHEN Name = 'NCM'     THEN 'Network Configuration Manager'
          WHEN Name = 'NPM'     THEN 'Network Performance Monitor'
          WHEN Name = 'NTA'     THEN 'NetFlow Traffic Analyzer'
          WHEN Name = 'Orion'   THEN 'Orion Core'
          WHEN Name = 'SEUM'    THEN 'Web Performance Analyzer'
          WHEN Name = 'SRM'     THEN 'Storage Resource Monitor'
          WHEN Name = 'Toolset' THEN 'Enterprise Toolset'
          WHEN Name = 'UDT'     THEN 'User Device Tracker'
          WHEN Name = 'VoIP'    THEN 'VoIP & Network Quality Manager'
          WHEN Name = 'EOC'     THEN 'Enterprise Operations Console'
          WHEN Name = 'VIM'     THEN 'Virtualization Manager'
          WHEN Name = 'SCM'     THEN 'Server Configuration Monitor'
          WHEN Name = 'OLM'     THEN 'Log Manager for Orion'
          ELSE Name
     END AS [Product Name]
     , Version
     , CASE
          WHEN IsEval = 'True' THEN  CONCAT('Evaluation (', [DaysRemaining], ' days left)')
          ELSE 'Licensed'
       END AS [License Type]
     
FROM Orion.InstalledModule
ORDER BY CASE
          WHEN Name = 'APM'     THEN 9
          WHEN Name = 'IPAM'    THEN 5
          WHEN Name = 'NCM'     THEN 4
          WHEN Name = 'NPM'     THEN 2
          WHEN Name = 'NTA'     THEN 3
          WHEN Name = 'Orion'   THEN 0
          WHEN Name = 'SEUM'    THEN 11
          WHEN Name = 'SRM'     THEN 10
          WHEN Name = 'Toolset' THEN 8
          WHEN Name = 'UDT'     THEN 6
          WHEN Name = 'VoIP'    THEN 7
          WHEN Name = 'EOC'     THEN 1
          WHEN Name = 'VIM'     THEN 4
          WHEN Name = 'SCM'     THEN 4
          WHEN Name = 'OLM'     THEN 4
          ELSE 99
        END
Orion Core2018.2Licensed
Network Performance Monitor12.3Licensed
NetFlow Traffic Analyzer4.4.0Licensed
Network Configuration Manager7.8Licensed
IP Address Manager4.7.0Licensed
VoIP & Network Quality Manager4.5.0Licensed
Enterprise Toolset11.0.6Licensed
Server & Application Monitor6.7.0Licensed
Storage Resource Monitor6.7.0Licensed

Just did a spot-check on my own environment:

Network Performance Monitor12.4Licensed
NetFlow Traffic Analyzer4.5.0Licensed
Server Configuration Monitor1.0.1Licensed
Network Configuration Manager7.9Licensed
Virtualization Manager8.3.1Licensed
Log Manager for Orion1.1.1Licensed
IP Address Manager4.8.0Licensed
User Device Tracker3.3.2Licensed
VoIP & Network Quality Manager4.5.1Licensed
Server & Application Monitor6.7.1Licensed
Storage Resource Monitor6.7.1Licensed
Web Performance Analyzer2.2.3Licensed

and found out that the Muted Nodes Resource Query does not work within SWQL Studio with the "ORDER BY" Clause, but it does work within the web console.  I'm thinking bug for SWQL Studio.  I'll raise the flag on that.

Hello,

Does anyone build a report for historical muted/unmanged entities. Let's say a user muted the alert for a period of time and then unmute(resume) the alerts. So by running below the queries we will be getting current muted/unmanaged reports. I am looking for a report where I can get historical muted entities as well. Please advise.

Good day

Thanks for these instructions and stricts...this widget was exactly what we were needing...

Question...when i load this into our web console we get info, however I get double...due i think because the "by" column has different user names as the "element column would be the same for the rest..

example:  the first 2 rows is for the same node but is showing was muted by 2 different people, even though I was the one that muted it...

same for the last 2 rows - same node but showing muted by 2 different people, when i was the one that muted it...

any thoughts?

pastedImage_0.png

You are 100% correct... and this is where my ability with SQL (and thus SWQL) filtering starts to fall short.  I've been meaning to get back to this update, but I just haven't had the cycles to circle back.

Any way to add Grouped Nodes to this as well?
I am not a SQL master and wouldn't know the strings to add, but we recently found a Group was muted and we didn't catch it for a few days.  Luckily there were no issues.

This is a great question!  Anyone willing to take a pass at extending the current SWQL query?

be warned; this is untested because we don't have any muted groups in our environment (I'm not even sure that's a native function outside of the API); but The App/Node/Interface parts I use in my environment so I am pretty sure the Groups will work too.

note: you may have to massage this a bit; I use this externally via API call, not in the SolarWinds website. it works fine in SWQL Studio

SELECT DISTINCT 
'APPLICATION' AS [OBJECT TYPE]
,app.FullyQualifiedName AS [NAME]
,app.DetailsUrl AS [_LinkFor_NAME]
,TOSTRING(TOLOCAL(suppress.SuppressFrom)) AS [START]
,ISNULL(TOSTRING(TOLOCAL(suppress.SuppressUntil)),'--No End--') AS [END]
,ISNULL(args.AuditingEvent.AccountID,'--No Record--') AS [ACCOUNT]
FROM Orion.AlertSuppression suppress
JOIN Orion.APM.Application app ON app.Uri = suppress.EntityUri AND app.UnManaged = 0
LEFT OUTER JOIN Orion.AuditingArguments args ON args.ArgsKey = 'EntityUri' AND args.ArgsValue = app.Uri

UNION ALL

( SELECT DISTINCT
'NODE' AS [OBJECT TYPE]
,node.Caption AS [NAME]
,node.DetailsURL AS [_LinkFor_NAME]
,TOSTRING(TOLOCAL(suppress.SuppressFrom)) AS [START]
,ISNULL(TOSTRING(TOLOCAL(suppress.SuppressUntil)),'--No End--') AS [END]
,ISNULL(args.AuditingEvent.AccountID,'--No Record--') AS [ACCOUNT]
FROM Orion.AlertSuppression suppress
JOIN Orion.Nodes node ON node.Uri = suppress.EntityUri AND node.UnManaged = 0
LEFT OUTER JOIN Orion.AuditingArguments args ON args.ArgsKey = 'EntityUri' AND args.ArgsValue = node.Uri )

UNION ALL

( SELECT DISTINCT
'INTERFACE' AS [OBJECT TYPE]
,interface.FullName AS [NAME]
,interface.DetailsURL AS [_LinkFor_NAME]
,TOSTRING(TOLOCAL(suppress.SuppressFrom)) AS [START]
,ISNULL(TOSTRING(TOLOCAL(suppress.SuppressUntil)),'--No End--') AS [END]
,ISNULL(args.AuditingEvent.AccountID,'--No Record--') AS [ACCOUNT]
FROM Orion.AlertSuppression suppress
JOIN Orion.NPM.Interfaces interface ON interface.Uri = suppress.EntityUri AND interface.UnManaged = 0
LEFT OUTER JOIN Orion.AuditingArguments args ON args.ArgsKey = 'EntityUri' AND args.ArgsValue = interface.Uri )

UNION ALL

( SELECT DISTINCT
'GROUP' AS [OBJECT TYPE]
,groups.Name AS [NAME]
,groups.DetailsURL AS [_LinkFor_NAME]
,TOSTRING(TOLOCAL(suppress.SuppressFrom)) AS [START]
,ISNULL(TOSTRING(TOLOCAL(suppress.SuppressUntil)),'--No End--') AS [END]
,ISNULL(args.AuditingEvent.AccountID,'--No Record--') AS [ACCOUNT]
FROM Orion.AlertSuppression suppress
JOIN Orion.Groups groups ON groups.Uri = suppress.EntityUri AND groups.UnManaged = 0
LEFT OUTER JOIN Orion.AuditingArguments args ON args.ArgsKey = 'EntityUri' AND args.ArgsValue = groups.Uri )

ORDER BY [START],[OBJECT TYPE],[NAME]

I just tested it and it works - but, YES, you can only mute a group (internally called a "Container") via the API.

pastedImage_0.png

Awesome, this helps out a lot as I believe we can see everything that is muted now.

Appreciate it!  And thanks for the quick replies!

It does give me some duplicate information which I will see if I can tweak a bit for my widget on my Dashboard.

Hi KMSigma,

in this query how do we twaek to show only those nodes in mute mode as for me it shows all nodes

Also how do we show one node only once as for me it shows all the mute activity enable for each node instead of showing the last one

What do you mean by "just for me?"  If someone else muted a resource, then it's muted for everyone - it's not a "per user" setting.

Sorry for the confusion

I ran a wrong query earlier that shows duplicate entries and now i use the below query which shows only nodes which are in mute modes

but I need a help in this query for 2 things

1. To sort by 'Mute From' (currently its based on Device Name)

2. Show the time in CST (currently it shows in UTC)

Custom Query

..................................

select n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

Search Query

..................................

select

n.caption as [Device], n.DetailsURL as [_LinkFor_Device]

,'/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Device]

,n.IP_Address as [IP], n.DetailsURL as [_LinkFor_IP]

, Alerts.SuppressFrom as [Mute from], Alerts.SuppressUntil as [Mute Until]

from Orion.AlertSuppression AlertS

join Orion.nodes n on n.uri = AlertS.EntityURI

where n.caption like '%${SEARCH_STRING}%'

Using your exact queries, I am seeing the times in the time zone of the "browser".

This machine is in US Central Time.

pastedImage_0.png

Red is the "database time" (I'm using UTC)

Yellow is the local time of the browser (CST).

This machine is in UTC.

pastedImage_1.png

Purple is database time (UTC)

Blue is browser time (also UTC).

Hi KMsigma,

I am in CST and running this locally but time shows in the query as UTC, how can I change the query, please help

Thanks

Lijin Sarachandran

Tower Lead – Team JOC

Athene Infrastructure Operations

Desk No: +1 949-407-1122

Mobile: +91 9995 269 269 (India)

Note: Please copy IMS-JOC@athene.com for Swift Response

Upcoming PTO: 09/10, 09/11, 09/12, 09/13

What versions are you runnning?  My system is running:

  • Orion Platform 2019.2 HF2
  • VNQM 4.6.0
  • SRM 6.9.0
  • IPAM 4.9.0 HF1
  • SAM 6.9.1
  • SCM 1.2.0 HF2
  • DPAIM 11.2.0
  • NCM 8.0
  • VMAN 8.5.0 HF1
  • NetPath 1.1.5
  • LA 2.1
  • NPM 12.5
  • NTA 4.6.0
  • UDT 3.4.0 HF1
  • WPM 3.0.0

hi KMSigma,

        Orion here does not have APS installed in anhui。Your command contains Orion.APM.Application elements.

  • Please help confirm how to modify the command 。

2019-10-31 12:10:20,433 [276] (697) ERROR SolarWinds.Orion.Web.InformationService.InformationServiceProxy - (null)  Source entity [Orion.APM.Application] not found in catalog

System.ServiceModel.FaultException`1[SolarWinds.InformationService.Contract2.InfoServiceFaultContract]: RunQuery failed, check fault information.

Source entity [Orion.APM.Application] not found in catalog (错误详细信息等于 InfoServiceFaultContract [ SolarWinds.Data.Query.EntityNotFoundException: Source entity [Orion.APM.Application] not found in catalog

Just comment out line numbers:

07-08

16-17

28-29

36-37

To do a comment, use double-dash '--'

Hello KMSigma,

I am new to Solarwinds I tried your SWQL query for creating Widget which can help us to find the muted alerts but getting error "There was an error processing the error"

I have NPM and NCM moudule 2019.4 Version

Version history
Revision #:
1 of 1
Last update:
‎12-20-2017 03:17 PM
Updated by: