Relic Solution: 2 Steps to Creating a great Alerts Dashboard

What if you want to track all alerts on your account in a single dashboard?

Like this…

Alerts data is not directly available in Insights. But, you can configure a webhook to send New Relic Alerts data to Insights. Here’s a dashboard you can easily create on your own account to track alert incidents.

Step 1: Follow this excellent community post to set up webhook to send alerts incident data to Insights:

Thank you @philweber :slight_smile:

If you already have Alerts data in Insights, you can skip to step 2.

Step 2: Use the json below to create a dashboard to track alerts using the Dashboard API:

Dashboard JSON
 {
  "dashboard": {
    "title": "Alerts Dashboard",
    "icon": "bell",
    "visibility": "all",
    "editable": "editable_by_all",
    "metadata": {
      "version": 1
    },
    "widgets": [
      {
        "visualization": "line_chart",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 1,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT filter(uniqueCount(incident_id), where `current_state` = 'open') as 'Open', filter(uniqueCount(incident_id), where `current_state` = 'acknowledged') as 'Acknowledged', filter(uniqueCount(incident_id), where `current_state` = 'closed') as 'Closed' FROM  Alerts  TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Open, Acknowledged and Closed Alerts",
          "notes": null
        }
      },
      {
        "visualization": "faceted_area_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET severity TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Alerts Priority",
          "notes": null
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT  average(duration /1000/60/60 ) as 'Hours' FROM Alerts where `current_state` in ( 'acknowledged') limit 2000"
          }
        ],
        "presentation": {
          "title": "Average Time to Acknowledge",
          "notes": null,
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT  average(duration/1000/60/60) as 'Hours' FROM Alerts  where `current_state` in ( 'closed') limit 2000"
          }
        ],
        "presentation": {
          "title": "Average Time to Close (Mean time to recovery)",
          "notes": "Mean time to recovery",
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 3,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT latest(timestamp), latest(condition_name), latest(current_state), latest(details), latest(policy_name),uniqueCount(incident_id)   from Alerts   FACET incident_id LIMIT max"
          }
        ],
        "presentation": {
          "title": "Recent Alert Activity ",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 4,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT latest(timestamp), latest(`current_state`), latest(details),latest(owner), latest(condition_name) FROM Alerts  facet incident_id where `current_state` in ( 'acknowledged') limit 100 WITH TIMEZONE 'Europe/Dublin'"
          }
        ],
        "presentation": {
          "title": "Alerts Acknowledged",
          "notes": null
        }
      },
      {
        "visualization": "event_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 5,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT incident_id, condition_name, current_state, details, policy_name   from Alerts  "
          }
        ],
        "presentation": {
          "title": "Alert Violation Details",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 2,
          "height": 1,
          "row": 6,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) as 'count of incidents' FROM Alerts FACET condition_name , policy_name"
          }
        ],
        "presentation": {
          "title": "Number of Alerts per Condition and Policy",
          "notes": null
        }
      },
      {
        "visualization": "faceted_area_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 6,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET condition_name, policy_name TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Alerts by Condition and policy",
          "notes": ""
        }
      },
      {
        "visualization": "facet_pie_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniqueCount(incident_id) from Alerts   facet policy_name"
          }
        ],
        "presentation": {
          "title": "Alerts by Policy",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniqueCount(incident_id) as 'count of incidents' FROM Alerts FACET policy_name, weekof(timestamp)"
          }
        ],
        "presentation": {
          "title": "Alert Policies Triggered by Week",
          "notes": null
        }
      },
      {
        "visualization": "comparison_line_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT count(*) FROM Alerts SINCE today COMPARE WITH 1 day AGO TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Total Alerts over Time",
          "notes": null
        }
      },
      {
        "visualization": "facet_bar_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET condition_name"
          }
        ],
        "presentation": {
          "title": "Alerts by Condition",
          "notes": null
        }
      },
      {
        "visualization": "uniques_list",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniques(policy_name) from Alerts limit 2000"
          }
        ],
        "presentation": {
          "title": "Alert Policies",
          "notes": null
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT percentage(uniqueCount(incident_id)  ,where details LIKE '%zara%s hosts%') as 'Alerts on Single Entity' FROM Alerts"
          }
        ],
        "presentation": {
          "title": "Alerts on a Single Entity",
          "notes": null,
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      }
    ],
    "filter": {
      "event_types": [
        "Alerts"
      ],
      "attributes": [
        "condition_family_id",
        "condition_name",
        "current_state",
        "details",
        "incident_acknowledge_url",
        "incident_id",
        "incident_url",
        "owner",
        "policy_name",
        "policy_url",
        "severity"
      ]
    }
  }
}

Make sure to replace the account_id attribute with your account id. For more information on the Dashboard API refer our docs: Insights Dashboard API

Let us know how you get on with this :smiley:

8 Likes

In the step 2,
I didn’t find the way to create a Dashboard from a JSON :neutral_face:

Hello, @Thomas.HAMOU: Click the link above that says, “Insights Dashboard API”.