Help on a NRQL query based alert

Hi,

I’d like some help on an NRQL query based alert.
I have the following query. The logic is:

• get the latest detail_state (SUCCEEDED or FAILED)
• raise alert if the latest event is failed
• alert should close when the latest event is <> failed

SELECT latest(detail_state) from codepipelineevents FACET detail_pipeline WHERE detail-type = ‘CodePipeline Pipeline Execution State Change’ and detail_pipeline =‘test-pipeline’ and detail_state=‘FAILED’

I would expect the count to be 0 if the latest event is <> failed. If the latest event is failed count should be 1 and an incident raised. When the next status update comes through the query would then return 0 rows and the incident is closed.

Any ideas how I can achieve this?

Thanks

Hi, @lloyd.mercer: NRQL alert conditions must return a number, so latest(detail_state) won’t work. How about:

SELECT count(*) 
FROM codepipelineevents 
WHERE detail-type = 'CodePipeline Pipeline Execution State Change' 
  AND detail_pipeline = 'test-pipeline' 
  AND detail_state = 'FAILED'

Trigger a violation when the above query returns a value greater than 0.

Hi,

Thanks for the reply. I had tried the above and yes this does work and trigger the alert. I would like the alert to be closed down when a subsequent message is SUCCESS. That’s why I thought I could check the latest event only.
I’m a bit stuck as to how to achieve it, any ideas?

Thanks

Lloyd

Hi, Lloyd: If the query returns a value greater than 0 (there has been at least one FAILED event), the alert condition will create a violation. If the query then returns a value of 0 failures for N minutes (whatever length of time you specify in the alert condition), the violation will automatically close.