Is there any way to change the TriggeredMessage of an Alert using the SDK?

I'd think you will have better luck updating the orion.alertconfiguration.Trigger value.   Alert active is more of a historical record of what happens after an alert fires.   The alert configuration is where those decisions about what needs to happen are made.   The trigger and reset are pretty big blocks of xml so it may take a bit to find the section to change, but your case might be simple enough for something like a straight replace(trigger, 'old message', 'new message').

I don't quite understand what you are proposing, there is no way of making the trigger extract the substring I want, that is why I am using an external script. What I am trying to do is out of a trap like this: IF-MIB:linkDown : sysUpTime = 3 hours 11 minutes 44.96 seconds, ifIndex.10 = 10, ifDescr.10 = Tunnel11, ifType.10 = 131, locIfReason.10 = Tunnel Down

I want to display on the router in question just the 'Tunnel Down' string as the alert message. This is just an example, not the real trap I am working with.

The reason I suggested you make the change inside the alertconfiguration is first of all because alertactive is not editable in the API, so its a non-starter right out of the gate.  If you wanted to change a message you need to change the alertconfiguration before the event actually happens.  If you did manage to edit the alertactive it still wouldn't be much help since the alert message would already have been emailed out unless you intentionally added a lag time between the alert firing to allow your script to make the change before the email gets sent.  All of this is adding WAY too much complexity to the issue.

So the root issue is you just want to display a substring of the message instead of the whole message, no need for any external complicated scripting or using the API anyway.  SWQL has substring() and charindex() functions so you can just handle it directly in Orion with SWQL or SQL with a custom variable.

Something like this should work as a custom SWQL variable:

${N=SWQL;M=select top 1 substring('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',charindex('locIfReason','${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+17,20)

from orion.nodes n}

I expect that's pretty similar to what you were doing in your external script, but there's not reason to add that all in when you can make it happen natively.

This seems like a really nice solution, thank you. What does the +17,20 do? Is it telling it how many chars to print after 'locIfReason.10 ='?

I tried using the SWQL variable, but it does not return the truncated substring.  Instead my code is returned along with the full string of the OLMAlertMessage.EventMessage.  What am I missing?

Post a screenshot of exactly how you have it set up and the result when it runs, when the whole query displays it usually indicates a syntax mistake was made somewhere.

Alert Configuration:

Result:

Do you have an IBM DataPower Gateway in your environment?  It looks like the error might be originating from there.

It's a trap from a Datapower device....

Looks like I made a mistake in the version I posted before, needed to assign a name to the column in SWQL or it wont run.

Try this

${N=SWQL;M=select top 1 substring('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',charindex('locIfReason','${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+17,20) as message

from orion.nodes n}