Change the alert action SNOW group from windows to sql team.

[raghunandan1]

Hi Team,

We have DB alerts for server sitpdb0033 are assigning to windows support team first , it needs to be assign to SQL team,
How to change the assignment group from windows support team to SQL team.

The index=mssql there are 30+ host's are configured. We want only change the group for this server sitpdb0033

we have using this SPL query:
index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE"

| eval assignment_group = case(like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")

Can you please help on this requirement.

Thank you

Nandan

[scelikok]

Hi @raghunandan1 ,

You can try below;

index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE" 
| eval assignment_group = case(host=="sitpdb0033","Sql_Production Support", like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")

[raghunandan1]

Thank you for your suggestions,

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.

[raghunandan1]

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.