4 Replies Latest reply on Oct 6, 2017 11:17 AM by jkhill

    newbie question on alert resources

    jkhill

      My company has been using SolarWinds for years but we've only ever concentrated on the generation of alerts, and the occasional one-off report to troubleshoot an issue.  I've been asked to start building out dashboards simple enough for even an executive to understand.  To that end, I'm trying to build views that focus on specific sets of devices.

       

      The first thing I did was create a custom property for nodes called Environment.  It's a dropdown with values like Dev, UAT and Prod.  I then imported my Environment values from a .csv I'd put together. 

       

      I'm now beginning to work on the view.  I started with a test view containing two resources:  All Dev Nodes (wsql:  Environment = 'Dev') and All Prod Nodes. 

       

      Now I'd like to add a resource called All Active Prod Alerts, but the Alerts resource doesn't allow me to add WSQL.  If I click Edit the only things I can change are Title, Subtitle and Show Acknowledged.  I'm clearly missing something obvious here - could someone point me in the right direction to filter Active Alerts by the parent node's Environment field?

       

      Many thanks!

        • Re: newbie question on alert resources
          mesverrum

          No you are not missing anything, the active alerts resource does not allow for any filtering.  One workaround is to apply a view limitation filtered by that custom property to the whole view instead of filtering each resource on the page, but then you would need to create a separate view for the dev environment.  I wrote a custom SWQL version of the Active alerts resource to give myself the ability to filter it however I needed.  Try this one in a custom query resource on that page.  Row 34 is where i filtered it to the custom property, if you want to make it searchable check the "search" box on the custom query resource and paste the same query with the comment marks removed from lines 35-36

           

          SELECT
            o.AlertConfigurations.Name AS [ALERT NAME]
            ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]
          ,CASE
          WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'
          WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'
          WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'
          WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'
          WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'
          END AS [_iconfor_ALERT NAME]
            ,o.EntityCaption AS [ALERT OBJECT]
            ,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]
          ,case
          WHEN o.RelatedNodeCaption=EntityCaption THEN 'Self'
          When o.RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption
          End as [RELATED NODE]
            ,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]
            ,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]
          -- ,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE]
          ,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE]
          ,CASE
          when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>1440 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')
          when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>60 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')
          else (tostring(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')
          end as [Time Active]
          ,aa.AcknowledgedBy
          ,ah.Message as [Note]
          
          From Orion.AlertActive aa
          join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid
          LEFT join Orion.Nodes p on p.nodeid=relatednodeid
          left join orion.alerthistory ah on ah.AlertActiveID=aa.AlertActiveID and ah.EventType in (2,3)
          
          where p.customproperties.Environment = 'Prod'
          --and (o.AlertConfigurations.Name like '%${SEARCH_STRING}%' or
          --o.RelatedNodeCaption like '%${SEARCH_STRING}%' or o.EntityCaption like '%${SEARCH_STRING}%' or ah.Message like '%${SEARCH_STRING}%')
          
          ORDER by o.AlertActive.TriggeredDateTime DESC