This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SWQL query to populate alert definition and (send-email) email address

Hi,

I am looking for a way to run a swql query to get the Alerts definition plus the email address (triggered action).

I have looked under all of the orion.alert* tables and do not see any correlation to the triggered action to show the email address being used (send-email).

Can you point me to the right direction or right table.


Thank you in advance!

  • Better clarification.  I need to join orion.ActionsProperties with Orion.AlertConfigurations

    Is there a table I can join on? 

    Thanks!

  • This might help

    select

    ac.name as  [Alert Name]

    , aa.categorytype

    , a.actiontypeid

    , ap.propertyname

    , ap.propertyvalue

    from orion.actionsassignments aa

    join orion.alertconfigurations ac on aa.parentid=ac.alertid

    join orion.actions a on a.actionid=aa.actionid

    join orion.actionsproperties ap on ap.actionid=a.actionid

    where propertyname like '%email%'

    or propertyname like 'sender'

    -Marc Netterfield

        Loop1 Systems: SolarWinds Training and Professional Services

  • You can join this chain: Orion.AlertConfigurations -> Orion.ActionsAssignments -> Orion.Actions -> Orion.ActionsProperties.

    Like this:

    SELECT AC.AlertID, AC.Name, AA.Action.ActionID, AA.Action.Title, AA.Action.Properties.PropertyName, AA.Action.Properties.PropertyValue

    FROM Orion.AlertConfigurations AC

    LEFT JOIN Orion.ActionsAssignments AA ON AC.AlertID=AA.ParentID AND AA.EnvironmentType='Alerting'

    WHERE AA.Action.Properties.PropertyName='EmailTo'