Can anyone provide an example of how to supress alerts using the rest API, I've stumbled around but I can't seem to get it to work.

The URL for suppressing alerts is:

/SolarWinds/InformationService/v3/Json/Invoke/Orion.AlertSuppression/SuppressAlerts

The payload for all .../Invoke/... URLs is a JSON array of the argument values in order. The three parameters are a list of element uris to suppress alerts for, a start time, and (optionally) a stop time. For your values, that would look like this:

[
     ["swis://URL/Orion/Orion.Nodes/NodeID=177"],
     "2017-06-26T15:00:00",
     "2017-06-26T15:30:00"
]

These times will be treated as UTC - which means that they are already in the past.

Awesome, thanks for the quick reply that seemed to do it.  Any ideas why these utc times 2017-06-26T19:00:00 - 2017-06-26T20:00:00  show up as the following in solarwinds?

This object is scheduled to be in Maintenance Mode (muted alerts) from 6/26/2017 7:00 PM to 6/26/2017 4:00 PM. Alerts for the object will not be triggered in the maintenance period.   Cancel

I checked implementation and it seems there is inconsistency how Orion process suspendFrom and suspendUntil regarding timezone transformation. SuspendUntil is incorrectly processed and timezone shift is added - in your case 4 hours I guess.

Try to provide date/time directly in UTC timezone by adding 'Z' in the end of datetime string:

swis.invoke('Orion.AlertSuppression', 'SuppressAlerts',
  [ 'swis://local/Orion/Orion.Nodes/NodeID=21' ],
  '2017-06-30T20:00:00Z',
  '2017-06-30T23:00:00Z'
)

Using this approach timezone processing should be consistent but you need to shift local time to UTC by yourself.

I have the same problem.  What I did was use local time for the SuppressFrom have to convert SuppressUntil to UTC.  When doing this though if I want to create a report using the events log even though it works correction and suppresses using the correct times on the node itself the start and stop time are incorrect in the audit log and ends up showing the start time in UTC and stop time in Local.  And if I do it the other way around then the start time actually becomes UTC and the stop time is correct.  Its a very weird bug.  However I am searching for a work around because I still want to be able to pull historical data.

Are you saying that if I convert to UTC prior to putting it into the Post Body and then by adding the Z it will force UTC?

Below is my code:

This is what I have but am having trouble getting the Z into the JSON body when using the datetime as a variable.

elseif($onOff -eq "mute") {

    $start = (Get-Date).ToUniversalTime()

$end = $start.AddYears(99)

$List.split(" ") | Foreach {

$node = Get-SwisData $swis "SELECT Uri FROM Orion.Nodes WHERE IP_Address = '$_'"

$json = "[[`"$node`"],`"$start`",`"$end`"]"

$json

Invoke-WebRequest -Uri $url -Credential $SWCreds -Method Post -Body $json -ContentType application/json | Out-Null

A piece of my original code that works functionally but reports incorrectly in the audit log is:

} elseif ($onOff -eq "duration") {

$start = Get-Date

$end = ($start.AddMinutes($Time)).ToUniversalTime()

$List.split(" ") | Foreach {

$node = Get-SwisData $swis "SELECT Uri FROM Orion.Nodes WHERE IP_Address = '$_'"

$json = "[[`"$node`"],`"$start`",`"$end`"]"

Invoke-WebRequest -Uri $url -Credential $SWCreds -Method Post -Body $json -ContentType application/json | Out-Null

#Write-Host $_ " - " $node " was unmanaged until" $end

}

This is still broke by the way.  I addressed this with SolarWinds, had them escalate this to the development team and still nothing.

This bug is tracked internally as CORE-8845. It is fixed in code that hasn't shipped yet. When the fix ships, I'll update this thread.

This fix shipped in Orion Platform 2018.4/NPM 12.4.

This is old and you've probably solved this but here's the answer to added the 'Z' to the end of the time in Powershell to force it to recognize the UTC.

     $body = "[[`"$NodeUri`"], `"$($StartTime)Z`", `"$($EndTime)Z`"]"

Evaluate the variable first with $() around it, then it will add the 'Z' to the end. I use most often to print the attribute of an object in a string when needed (ie. "$($File.fullname)"), but it will just return the string if the variable is just a string.