cancel
Showing results for 
Search instead for 
Did you mean: 
stevehhcp
Level 8

Custom SWQL Query of Active Alert filter out "unmanaged"

I have adapted one of the custom alert queries I found here and was able to edit it to my needs and get it work. However I am stuck on one piece and I hope to get some help.

I have a Where Clause that will filter out alert that I do not want to see "where o.AlertConfigurations.Name not like 'alert I don't want to see'"

Where I am stuck is it still returns alerts on node that have been unmanaged. Can anyone assist me with the logic on a Where Clause to filter out nodes that have been unmanaged? if that is possible.

Or does the filter to show only managed Node exist some where else in these queries?

0 Kudos
3 Replies
Highlighted
m-milligan
Level 13

Re: Custom SWQL Query of Active Alert filter out "unmanaged"

What kind of alert is it (Node, etc.)? Assuming this is a Node alert, add this line to your query's Where Clause:

AND Nodes.Unmanaged = 0

This will give you alerts only for nodes that are not unmanaged.

0 Kudos
stevehhcp
Level 8

Re: Custom SWQL Query of Active Alert filter out "unmanaged"

It was the query for alerts, that was the correct Answer on https://thwack.solarwinds.com/message/413978#384689

Unfortunately "AND Nodes.Unmanaged = 0" thew an error

0 Kudos
serena
Level 16

Re: Custom SWQL Query of Active Alert filter out "unmanaged"

stevehhcp  wrote:

It was the query for alerts, that was the correct Answer on Re: Filter Active Alerts on Dashboard 

Unfortunately "AND Nodes.Unmanaged = 0" thew an error

It's possible that's not the issue. For instance if I go to http://{orion server}/orion/admin/swis.aspx

and run this query:

SELECT IP, IP_Address, IPAddress, MachineType, NodeID, NodeName, UnManaged, UnManageFrom, UnManageUntil,Vendor, VendorIcon FROM Orion.Nodes WHERE Unmanaged = 0

Unmanaged = 0 is completely fine.

pastedImage_3.png

0 Kudos