1 Reply Latest reply on Jan 23, 2017 9:19 AM by ralch

    How to create a simple Alert with SWQL?

    ralch

      Hi,

       

      We want to create an alert when one of our interfaces stop receiveng Netflow data.

       

      So I the Alert Manager we created an alert and it produces the following SWQL:

       

      SELECT E0.[Uri], E0.[DisplayName]

      FROM Orion.NPM.Interfaces AS E0

      WHERE ( ( E0.[NetflowSource].[LastTime] < '20170120 16:30:00' ) )

       

      However instead of using a fixed date I need to use GetDate() since we are supposed to receive netflows constantly.  So I believe it should be a simple thing of using the following:

       

      SELECT E0.[Uri], E0.[DisplayName]

      FROM Orion.NPM.Interfaces AS E0

      WHERE ( ( E0.[NetflowSource].[LastTime] < GetDate() ) )

       

      Unfortunately the web interface of Solarwinds expects two fixed values.  One for date and another for the time.   This interface does not allow to continue unless I specify two fixed values but that would not work as we expect.

       

      When I inspect the generated SWQL, the interface does not allow to rewrite the query. 

       

      How could I solve this problem?

       

      Thank you

      alert.PNG