API: Get count of events *above a certain severity* in the past month

[forbiddenlake]

Using the API against a Zabbix 2.4.6 server, I am able to get a count of acknowledged events in a certain time frame (aka the number of problems acted on by IT).
Now, I would like to get a count of events above a certain severity in that same time frame (aka the number of problems that also resolved themselves, but without Informational events), but I don't see how to get that, since an event does not appear to have a severity to select on. And while I can use selectRelatedObject to get the trigger id, the object returned by event.get only has the the trigger id and no other information so it appears I can't filter on that either.

Current code (Perl):

$json = {
        method => "event.get", jsonrpc => "2.0", output => "extend", auth => $authID, id => $id,
        params => {
                source => 0, # trigger events
                object => 0, # created by a trigger
                time_from => time() - 60*60+1,
                #countOutput => "true",
                selectRelatedObject => "true",
                limit => 15, #for testing
        },
};

Example returned object (as printed by Data:umper) (this is an Information-severity trigger):

          {
            'source' => '0',
            'object' => '0',
            'acknowledged' => '0',
            'value' => '1',
            'objectid' => '37727',
            'ns' => '479029323',
            'clock' => '1441137895',
            'eventid' => '894739',
            'relatedObject' => {
                                 'triggerid' => '37727'
                               }
          }

The event detail page (tr_events.php?triggerid=37727&eventid=894739) has a Severity, but I don't know how it's getting it. I don't really want to send another API request for all thousands of events in the past month and do my own filtering.

So, how would I get a count of Average-severity and above events detected by Zabbix in the past month?

[gleepwurp]

Hi,

just looked at the tr_events.php and it looks like its getting both the event list and the trigger list:

// triggers
$triggers = API::Trigger()->get([
        'output' => API_OUTPUT_EXTEND,
        'selectHosts' => API_OUTPUT_EXTEND,
        'triggerids' => getRequest('triggerid')
]);

if (!$triggers) {
        access_deny();
}

$trigger = reset($triggers);

// events
$events = API::Event()->get([
        'output' => API_OUTPUT_EXTEND,
        'select_alerts' => API_OUTPUT_EXTEND,
        'select_acknowledges' => API_OUTPUT_EXTEND,
        'selectHosts' => API_OUTPUT_EXTEND,
        'source' => EVENT_SOURCE_TRIGGERS,
        'object' => EVENT_OBJECT_TRIGGER,
        'eventids' => getRequest('eventid'),
        'objectids' => getRequest('triggerid')
]);

I'm afraid you won't have any choice but to get a list of both events and triggers, match them both and then sort internally.

G.