I am attempting to create a dashboard which lists all open incidents (Similar to the ‘Open Incidents’ section under Alerts).
In this dashboard I want to select the hostname and the condition name for servers experiencing an open violation right now. I have created a violation condition named ‘Open Test’ for this. My current strategy is a query which goes:
SELECT hostname, conditionName FROM InfrastructureEvent WHERE conditionName =‘Open test’ AND violationUpdateType = ‘Opened’ Since 1 week ago
The problem with this is that when a violation is open New Relic creates an entry for it in InfrastructureEvent, and then when it is closed New Relic creates a new entry stating it is closed, rather than update the previous opened entry. This means that my query will obviously select all the entries where the violationUpdateType reads opened, meaning it will select entries where this occurred within the past week. This means serves which have violations that are right now closed will appear, as they were open at some point within the past week and those entries are still in the data and have not been altered.
I need a strategy that will allow me to select servers which are experiencing an open violation RIGHT NOW, which updates as the violation closes. Does anyone have any clever suggestions?