• State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 23 subscribers
  • Views 2379 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SWQL and Active Alerts

stevengj1

I am trying to create a dashboard that has Active Alerts. We have SW integrated with Service Now so on this dashboard I want to show alerts that are assigned to a particular Assignment Group in Service Now. In SWQL Studio the query works correctly and returns the correct number of records but when I put this in as Custom Query in the dashboard no records are return.  If I remove the where clause in the dashboard it will return all of the active alerts.  Any ideas why it would not work in the dashboard, is there any limitation on the SWQL  compared to the Studio. Thanks

SELECT ac.Name AS [Alert],  

       '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(ao.AlertObjectID) AS [_LinkFor_Alert],

       ac.AlertMessage AS [Message], 

       ao.EntityCaption AS [Object], 

       ao.EntityDetailsUrl AS [_LinkFor_Object],

       aa.TriggeredDateTime as [Triggered Date],

       ao.LastTriggeredDateTime AS [Last Triggered On], 

       ao.RelatedNodeCaption AS [Node], 

       ao.RelatedNodeDetailsUrl AS [_LinkFor_Node],

       ao.AlertIncident.IncidentNumber as [Incident Number],

       ao.AlertObjectID AS [_LinkFor_Incident Number],

       ao.AlertIncident.AssignedTo AS [Assignment Group],

       ao.AlertObjectID AS [_LinkFor_Assignment Group],

      

CASE WHEN aa.TriggeredDateTime IS NULL THEN NULL ELSE (

    TOSTRING(FLOOR(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +

    TOSTRING(MINUTEDIFF(aa.TriggeredDateTime,GETUTCDATE())%60) + 'm'

) END AS [ACTIVE TIME]

FROM Orion.AlertActive AS aa 

LEFT OUTER JOIN Orion.AlertObjects AS ao ON aa.AlertObjectID = ao.AlertObjectID

LEFT OUTER JOIN Orion.AlertConfigurations AS ac ON ao.AlertID = ac.AlertID

WHERE ao.AlertIncident.AssignedTo = 'Global Network Services'

ORDER BY  aa.TriggeredDateTime

  • 0

    Did some more testing and it seem as soon as I add there where clause no data comes back. When doing the same exact query in SWQL Studio it works fine

  • 0 in reply to stevengj1

    Do you have a view limitation applied to the dashboard?

  • 0 in reply to stevengj1

    Hello,

    I've checked that your query works fine and since the where clause is making the difference I also suspect limitations. If that would be an account limitation, you could easily check in SWQL studio by logging as user you log into Orion. However, view limitations are bind to view. Could you please clarify whether you have any limitations applied?

    Furthermore, I'd try a simplified version that does not contain any rendered node reference which is most probably where it gets filtered.

    SELECT [AC].[Name] AS [Alert]

    FROM [Orion].[AlertActive] AS [AA]

    JOIN [Orion].[AlertObjects] AS [AO] ON [AA].[AlertObjectID] = [AO].[AlertObjectID]

    JOIN [Orion].[AlertConfigurations] AS [AC] ON [AO].[AlertID] = [AC].[AlertID]

    WHERE [AO].[AlertIncident].[AssignedTo] = 'Global Network Services'

    Regards,

    Vaclav

  • 0 in reply to mesverrum

    Thanks a lot, that did it. I had a limitation define on the view once that was remove the query worked.

  • 0 in reply to VáclavSáblík

    Thanks a lot also for the reply, it was account limitation that cause the issue.  I will also try your simplified version.

  • 0

    I also have same concern, we have around thousands of active alerts, wants to assign them to respective team but unable fetch the details.

    I want the details like alert details, node name, triggered message ,assignment group(custom property).

    the assignment group is created respective alert like node, interface, volume, application etc.

    please suggest

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.