Your data. Anywhere you go.

New Relic for iOS or Android


Download on the App Store    Android App on Google play


New Relic Insights App for iOS


Download on the App Store


Learn more

Close icon

Relic Solution: 2 Steps to Creating a great Alerts Dashboard

alerts
insights

#1

What if you want to track all alerts on your account in a single dashboard?

Like this…

Alerts data is not directly available in Insights. But, you can configure a webhook to send New Relic Alerts data to Insights. Here’s a dashboard you can easily create on your own account to track alert incidents.

Step 1: Follow this excellent community post to set up webhook to send alerts incident data to Insights:

Thank you @philweber :slight_smile:

If you already have Alerts data in Insights, you can skip to step 2.

Step 2: Use the json below to create a dashboard to track alerts using the Dashboard API:

Dashboard JSON
 {
  "dashboard": {
    "title": "Alerts Dashboard",
    "icon": "bell",
    "visibility": "all",
    "editable": "editable_by_all",
    "metadata": {
      "version": 1
    },
    "widgets": [
      {
        "visualization": "line_chart",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 1,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT filter(uniqueCount(incident_id), where `current_state` = 'open') as 'Open', filter(uniqueCount(incident_id), where `current_state` = 'acknowledged') as 'Acknowledged', filter(uniqueCount(incident_id), where `current_state` = 'closed') as 'Closed' FROM  Alerts  TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Open, Acknowledged and Closed Alerts",
          "notes": null
        }
      },
      {
        "visualization": "faceted_area_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET severity TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Alerts Priority",
          "notes": null
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT  average(duration /1000/60/60 ) as 'Hours' FROM Alerts where `current_state` in ( 'acknowledged') limit 2000"
          }
        ],
        "presentation": {
          "title": "Average Time to Acknowledge",
          "notes": null,
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 2,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT  average(duration/1000/60/60) as 'Hours' FROM Alerts  where `current_state` in ( 'closed') limit 2000"
          }
        ],
        "presentation": {
          "title": "Average Time to Close (Mean time to recovery)",
          "notes": "Mean time to recovery",
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 3,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT latest(timestamp), latest(condition_name), latest(current_state), latest(details), latest(policy_name),uniqueCount(incident_id)   from Alerts   FACET incident_id LIMIT max"
          }
        ],
        "presentation": {
          "title": "Recent Alert Activity ",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 4,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT latest(timestamp), latest(`current_state`), latest(details),latest(owner), latest(condition_name) FROM Alerts  facet incident_id where `current_state` in ( 'acknowledged') limit 100 WITH TIMEZONE 'Europe/Dublin'"
          }
        ],
        "presentation": {
          "title": "Alerts Acknowledged",
          "notes": null
        }
      },
      {
        "visualization": "event_table",
        "layout": {
          "width": 3,
          "height": 1,
          "row": 5,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT incident_id, condition_name, current_state, details, policy_name   from Alerts  "
          }
        ],
        "presentation": {
          "title": "Alert Violation Details",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 2,
          "height": 1,
          "row": 6,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) as 'count of incidents' FROM Alerts FACET condition_name , policy_name"
          }
        ],
        "presentation": {
          "title": "Number of Alerts per Condition and Policy",
          "notes": null
        }
      },
      {
        "visualization": "faceted_area_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 6,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET condition_name, policy_name TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Alerts by Condition and policy",
          "notes": ""
        }
      },
      {
        "visualization": "facet_pie_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniqueCount(incident_id) from Alerts   facet policy_name"
          }
        ],
        "presentation": {
          "title": "Alerts by Policy",
          "notes": null
        }
      },
      {
        "visualization": "facet_table",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniqueCount(incident_id) as 'count of incidents' FROM Alerts FACET policy_name, weekof(timestamp)"
          }
        ],
        "presentation": {
          "title": "Alert Policies Triggered by Week",
          "notes": null
        }
      },
      {
        "visualization": "comparison_line_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 7,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT count(*) FROM Alerts SINCE today COMPARE WITH 1 day AGO TIMESERIES"
          }
        ],
        "presentation": {
          "title": "Total Alerts over Time",
          "notes": null
        }
      },
      {
        "visualization": "facet_bar_chart",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 1
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniquecount(incident_id) FROM Alerts FACET condition_name"
          }
        ],
        "presentation": {
          "title": "Alerts by Condition",
          "notes": null
        }
      },
      {
        "visualization": "uniques_list",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 2
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT uniques(policy_name) from Alerts limit 2000"
          }
        ],
        "presentation": {
          "title": "Alert Policies",
          "notes": null
        }
      },
      {
        "visualization": "billboard",
        "layout": {
          "width": 1,
          "height": 1,
          "row": 8,
          "column": 3
        },
        "account_id": 2170415,
        "data": [
          {
            "nrql": "SELECT percentage(uniqueCount(incident_id)  ,where details LIKE '%zara%s hosts%') as 'Alerts on Single Entity' FROM Alerts"
          }
        ],
        "presentation": {
          "title": "Alerts on a Single Entity",
          "notes": null,
          "threshold": {
            "red": null,
            "yellow": null
          }
        }
      }
    ],
    "filter": {
      "event_types": [
        "Alerts"
      ],
      "attributes": [
        "condition_family_id",
        "condition_name",
        "current_state",
        "details",
        "incident_acknowledge_url",
        "incident_id",
        "incident_url",
        "owner",
        "policy_name",
        "policy_url",
        "severity"
      ]
    }
  }
}

Make sure to replace the account_id attribute with your account id. For more information on the Dashboard API refer our docs: Insights Dashboard API

Let us know how you get on with this :smiley:


NRQL to fetch incidents that are created/raised for Applications