locked
Powershell - Query alerts from specific alert view RRS feed

  • Question

  • Hi Guys

    Is it possible to query all alerts from an alert view in SCOM?
    Havent found something via google or search.

    Thanks,
    Michael


    • Edited by Grimbi.de Thursday, August 25, 2016 8:13 AM
    Thursday, August 25, 2016 7:19 AM

Answers

  • Hi Sir,

    AFAIK , the command doesn't have a parameter for 'view' . Because , 'view' is  a filter not a container .

    I'd suggest you to follow the article below to filter alerts:

    http://blog.coretech.dk/jgs/scom2012-using-the-get-scomalert-criteria-parameter-complete-reference/

    Hope it is helpful to you .

    Best Regards,

    Elton


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com .

    • Proposed as answer by Elton_Ji Monday, September 5, 2016 1:40 PM
    • Marked as answer by Elton_Ji Wednesday, September 7, 2016 2:47 PM
    Friday, August 26, 2016 1:39 PM

All replies

  • use the powershell
    get-scomalert |where-object{$_.resolutionstate -eq '0'}
    Roger
    Thursday, August 25, 2016 7:35 AM
  • Hi Roger

    This will display all new alerts.
    How can I filter down on the criterias of a specific alert view I created.
    Reason why is because I want to ammend the alert view but dont want to ammend the script all the time something changes on the view.

    Not sure whether that is possible via powershell. Could it be that I need to query something from the database?

    Thanks,
    Michael

    Thursday, August 25, 2016 8:01 AM
  • Alternativly is there a SQL query for this?
    I already found the Alert View but I am not sure how to querie for the alerts behind it.

    select vv.id as 'View Id', 
    vv.displayname as 'View DisplayName', 
    vv.name as 'View Name', 
    vtv.DisplayName as 'ViewType', 
    mpv.FriendlyName as 'MP Name' 
    from ViewsView vv 
    inner join managementpackview mpv on mpv.id = vv.managementpackid 
    inner join viewtypeview vtv on vtv.id = vv.monitoringviewtypeid 
    where vv.displayname like 'Warnings S-4'

    Thursday, August 25, 2016 9:47 AM
  • Hi Sir,

    AFAIK , the command doesn't have a parameter for 'view' . Because , 'view' is  a filter not a container .

    I'd suggest you to follow the article below to filter alerts:

    http://blog.coretech.dk/jgs/scom2012-using-the-get-scomalert-criteria-parameter-complete-reference/

    Hope it is helpful to you .

    Best Regards,

    Elton


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com .

    • Proposed as answer by Elton_Ji Monday, September 5, 2016 1:40 PM
    • Marked as answer by Elton_Ji Wednesday, September 7, 2016 2:47 PM
    Friday, August 26, 2016 1:39 PM