Hello,
I am working on making a "Acknowledged Alerts" custom query. I have got a basic one working, which is using the following SWQL:
SELECT
tolocal(Status.TriggerTimeStamp) AS [Time of Alert],
Status.ObjectName AS [Alert],
Defs.Name AS [Category],
tolocal(Status.AcknowledgedTime) AS [Acked Time],
Status.AcknowledgedBy AS [Acked By],
Status.Notes
FROM
Orion.AlertStatus
AS Status
INNER JOIN Orion.AlertDefinitions
AS Defs
ON Status.AlertDefID = Defs.AlertDefID
WHERE
Acknowledged = 1
ORDER BY TriggerTimeStamp
This query works as expected. However, unlike the built in "Active Alerts" component it lacks any clickable links to bring you to the node/volume/whatever in question that the alert references. I want to remedy this, and read The Magic of SWQL: Create "All Components With Problems" Resource With Clickable Links, Status Icons and Even Hovers As A Bonus which seems to indicate that this is possible in SWQL. However, I am having issues.
Alerts as viewed in the Orion.AlertStatus table can have a variety of ObjectTypes, and the ActiveObject identifier points to a different table depending on that object type. Thus, Outer Left Joins would need to be used to dig into that respective table to get more information as to what that ActiveObject for the alert is. I've gotten that (presumably) to work, but the key is that unlike in that linked document I will need to use some sort of conditional logic to dicate what link format is used for just one of the columns (in my case, "Alert"). Here is what I am trying, but it is failing:
SELECT
tolocal(AStat.TriggerTimeStamp) AS [Time of Alert],
AStat.ObjectName AS [Alert],
ADefs.Name AS [Category],
tolocal(AStat.AcknowledgedTime) AS [Acked Time],
AStat.AcknowledgedBy AS [Acked By],
AStat.Notes,
CASE AStat.ObjectType
WHEN 'Node' THEN '/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(Nodes.NodeID) AS [_LinkFor_Alert]
WHEN 'Hardware Sensor' THEN '/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(Hardware.NodeID) AS [_LinkFor_Alert]
END
FROM
Orion.AlertStatus
AS AStat
INNER JOIN Orion.AlertDefinitions
AS ADefs
ON AStat.AlertDefID = ADefs.AlertDefID
LEFT OUTER JOIN Orion.Nodes
AS Nodes
ON Nodes.NodeID = AStat.ActiveObject AND AStat.ObjectType = 'Node'
LEFT OUTER JOIN Orion.HardwareHealth.HardwareItem
AS Hardware
ON Hardware.ID = AStat.ActiveObject AND AStat.ObjectType = 'Hardware Sensor'
WHERE
Acknowledged = 1
ORDER BY TriggerTimeStamp
Does SWQL support CASE statements? If so, what am I doing wrong with the syntax? When ran in SWQL Studio it seems to be chewing on the plus symbol.
If SWQL doesn't support CASE statements, how can I build this query so that the link goes to the right place even though the AlertStatus table doesn't have a easy way to allow for doing so?