I am trying to create a dashboard that has Active Alerts. We have SW integrated with Service Now so on this dashboard I want to show alerts that are assigned to a particular Assignment Group in Service Now. In SWQL Studio the query works correctly and returns the correct number of records but when I put this in as Custom Query in the dashboard no records are return. If I remove the where clause in the dashboard it will return all of the active alerts. Any ideas why it would not work in the dashboard, is there any limitation on the SWQL compared to the Studio. Thanks
SELECT ac.Name AS [Alert],
'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(ao.AlertObjectID) AS [_LinkFor_Alert],
ac.AlertMessage AS [Message],
ao.EntityCaption AS [Object],
ao.EntityDetailsUrl AS [_LinkFor_Object],
aa.TriggeredDateTime as [Triggered Date],
ao.LastTriggeredDateTime AS [Last Triggered On],
ao.RelatedNodeCaption AS [Node],
ao.RelatedNodeDetailsUrl AS [_LinkFor_Node],
ao.AlertIncident.IncidentNumber as [Incident Number],
ao.AlertObjectID AS [_LinkFor_Incident Number],
ao.AlertIncident.AssignedTo AS [Assignment Group],
ao.AlertObjectID AS [_LinkFor_Assignment Group],
CASE WHEN aa.TriggeredDateTime IS NULL THEN NULL ELSE (
TOSTRING(FLOOR(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +
TOSTRING(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())%60) + 'm'
) END AS [ACTIVE TIME]
FROM Orion.AlertActive AS aa
LEFT OUTER JOIN Orion.AlertObjects AS ao ON aa.AlertObjectID = ao.AlertObjectID
LEFT OUTER JOIN Orion.AlertConfigurations AS ac ON ao.AlertID = ac.AlertID
WHERE ao.AlertIncident.AssignedTo = 'Global Network Services'
ORDER BY aa.TriggeredDateTime
I also have same concern, we have around thousands of active alerts, wants to assign them to respective team but unable fetch the details.
I want the details like alert details, node name, triggered message ,assignment group(custom property).
the assignment group is created respective alert like node, interface, volume, application etc.
I've checked that your query works fine and since the where clause is making the difference I also suspect limitations. If that would be an account limitation, you could easily check in SWQL studio by logging as user you log into Orion. However, view limitations are bind to view. Could you please clarify whether you have any limitations applied?
Furthermore, I'd try a simplified version that does not contain any rendered node reference which is most probably where it gets filtered.
SELECT [AC].[Name] AS [Alert]
FROM [Orion].[AlertActive] AS [AA]
JOIN [Orion].[AlertObjects] AS [AO] ON [AA].[AlertObjectID] = [AO].[AlertObjectID]
JOIN [Orion].[AlertConfigurations] AS [AC] ON [AO].[AlertID] = [AC].[AlertID]
WHERE [AO].[AlertIncident].[AssignedTo] = 'Global Network Services'
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.