cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 10

SWQL and Active Alerts

I am trying to create a dashboard that has Active Alerts. We have SW integrated with Service Now so on this dashboard I want to show alerts that are assigned to a particular Assignment Group in Service Now. In SWQL Studio the query works correctly and returns the correct number of records but when I put this in as Custom Query in the dashboard no records are return.  If I remove the where clause in the dashboard it will return all of the active alerts.  Any ideas why it would not work in the dashboard, is there any limitation on the SWQL  compared to the Studio. Thanks

SELECT ac.Name AS [Alert],  

       '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(ao.AlertObjectID) AS [_LinkFor_Alert],

       ac.AlertMessage AS [Message], 

       ao.EntityCaption AS [Object], 

       ao.EntityDetailsUrl AS [_LinkFor_Object],

       aa.TriggeredDateTime as [Triggered Date],

       ao.LastTriggeredDateTime AS [Last Triggered On], 

       ao.RelatedNodeCaption AS [Node], 

       ao.RelatedNodeDetailsUrl AS [_LinkFor_Node],

       ao.AlertIncident.IncidentNumber as [Incident Number],

       ao.AlertObjectID AS [_LinkFor_Incident Number],

       ao.AlertIncident.AssignedTo AS [Assignment Group],

       ao.AlertObjectID AS [_LinkFor_Assignment Group],

      

CASE WHEN aa.TriggeredDateTime IS NULL THEN NULL ELSE (

    TOSTRING(FLOOR(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +

    TOSTRING(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())%60) + 'm'

) END AS [ACTIVE TIME]

FROM Orion.AlertActive AS aa 

LEFT OUTER JOIN Orion.AlertObjects AS ao ON aa.AlertObjectID = ao.AlertObjectID

LEFT OUTER JOIN Orion.AlertConfigurations AS ac ON ao.AlertID = ac.AlertID

WHERE ao.AlertIncident.AssignedTo = 'Global Network Services'

ORDER BY  aa.TriggeredDateTime

Tags (1)
6 Replies
Level 10

I also have same concern, we have around thousands of active alerts, wants to assign them to respective team but unable fetch the details.

I want the details like alert details, node name, triggered message ,assignment group(custom property).

the assignment group is created respective alert like node, interface, volume, application etc.

please suggest

0 Kudos
Level 10

Did some more testing and it seem as soon as I add there where clause no data comes back. When doing the same exact query in SWQL Studio it works fine

0 Kudos

Hello,

I've checked that your query works fine and since the where clause is making the difference I also suspect limitations. If that would be an account limitation, you could easily check in SWQL studio by logging as user you log into Orion. However, view limitations are bind to view. Could you please clarify whether you have any limitations applied?

Furthermore, I'd try a simplified version that does not contain any rendered node reference which is most probably where it gets filtered.

SELECT [AC].[Name] AS [Alert]

FROM [Orion].[AlertActive] AS [AA]

JOIN [Orion].[AlertObjects] AS [AO] ON [AA].[AlertObjectID] = [AO].[AlertObjectID]

JOIN [Orion].[AlertConfigurations] AS [AC] ON [AO].[AlertID] = [AC].[AlertID]

WHERE [AO].[AlertIncident].[AssignedTo] = 'Global Network Services'

Regards,

Vaclav

0 Kudos

Thanks a lot also for the reply, it was account limitation that cause the issue.  I will also try your simplified version.

0 Kudos

Do you have a view limitation applied to the dashboard?

- Marc Netterfield, Github

Thanks a lot, that did it. I had a limitation define on the view once that was remove the query worked.