Hello,
I am working on making a "Acknowledged Alerts" custom query. I have got a basic one working, which is using the following SWQL:
SELECT tolocal(Status.TriggerTimeStamp) AS [Time of Alert], Status.ObjectName AS [Alert], Defs.Name AS [Category], tolocal(Status.AcknowledgedTime) AS [Acked Time], Status.AcknowledgedBy AS [Acked By], Status.Notes FROM Orion.AlertStatus AS Status INNER JOIN Orion.AlertDefinitions AS Defs ON Status.AlertDefID = Defs.AlertDefID WHERE Acknowledged = 1 ORDER BY TriggerTimeStamp
This query works as expected. However, unlike the built in "Active Alerts" component it lacks any clickable links to bring you to the node/volume/whatever in question that the alert references. I want to remedy this, and read The Magic of SWQL: Create "All Components With Problems" Resource With Clickable Links, Status Icons and Even Hovers As A Bonus which seems to indicate that this is possible in SWQL. However, I am having issues.
Alerts as viewed in the Orion.AlertStatus table can have a variety of ObjectTypes, and the ActiveObject identifier points to a different table depending on that object type. Thus, Outer Left Joins would need to be used to dig into that respective table to get more information as to what that ActiveObject for the alert is. I've gotten that (presumably) to work, but the key is that unlike in that linked document I will need to use some sort of conditional logic to dicate what link format is used for just one of the columns (in my case, "Alert"). Here is what I am trying, but it is failing:
SELECT tolocal(AStat.TriggerTimeStamp) AS [Time of Alert], AStat.ObjectName AS [Alert], ADefs.Name AS [Category], tolocal(AStat.AcknowledgedTime) AS [Acked Time], AStat.AcknowledgedBy AS [Acked By], AStat.Notes, CASE AStat.ObjectType WHEN 'Node' THEN '/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(Nodes.NodeID) AS [_LinkFor_Alert] WHEN 'Hardware Sensor' THEN '/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(Hardware.NodeID) AS [_LinkFor_Alert] END FROM Orion.AlertStatus AS AStat INNER JOIN Orion.AlertDefinitions AS ADefs ON AStat.AlertDefID = ADefs.AlertDefID LEFT OUTER JOIN Orion.Nodes AS Nodes ON Nodes.NodeID = AStat.ActiveObject AND AStat.ObjectType = 'Node' LEFT OUTER JOIN Orion.HardwareHealth.HardwareItem AS Hardware ON Hardware.ID = AStat.ActiveObject AND AStat.ObjectType = 'Hardware Sensor' WHERE Acknowledged = 1 ORDER BY TriggerTimeStamp
Does SWQL support CASE statements? If so, what am I doing wrong with the syntax? When ran in SWQL Studio it seems to be chewing on the plus symbol.
If SWQL doesn't support CASE statements, how can I build this query so that the link goes to the right place even though the AlertStatus table doesn't have a easy way to allow for doing so?