Hey kedar — your read is correct, and the screenshots pin it down. The error is building the request as "0/events/query", which means the analytics input is taking your Analytics URL value (saved as "0") and tacking "/events/query" onto it — so it never picks up your On-Prem URL. That's why the scheme is missing, and why SaaS works but on-prem doesn't.
What's happening under the hood: the analytics search input doesn't talk to the controller — it talks to the AppDynamics Events Service, which is a separate endpoint (default port 9080, https). That's exactly why your other inputs (high level status, license usage, snapshots) are fine — those hit the controller, and your controller connection is good. Only analytics goes to the Events Service, and that's where the URL handling breaks.
The "Analytics URL" column is a pick-list of the SaaS analytics domains. On-prem has no matching entry, so it ends up stored as "0", and the input uses that instead of falling back to your "Optional On-Prem URL". That lines up with what you're seeing — it looks like a genuine bug in the add-on's on-prem analytics path, not something you misconfigured.
Two things worth trying:
- Confirm the endpoint you should be pointing at. On-prem analytics is the Events Service, not the controller — typically https://your-events-service-host:9080 (use the load-balancer VIP if the Events Service is clustered), and make sure the Splunk host can actually reach it on 9080/https. A common trip-up is putting the controller URL in the on-prem field; that won't work even once the "0" is sorted.
- Set the URL directly in the conf as a workaround. These UCC-based connections are stored in the add-on's local conf (look under $SPLUNK_HOME/etc/apps/Splunk_TA_AppDynamics/local/ — folder name may differ — and grep the conf files for the analytics account stanza; you'll find the field sitting at "0"). Back it up, set that field to your full https://your-events-service-host:9080, and restart. If the input reads that field, it sidesteps the broken pick-list.
Given it reproduces across multiple versions and only on-prem, I'd also open a Splunk Support case (or report it on the add-on's Splunkbase page) with the error plus the conf showing the analytics URL stored as 0 — that's a clean repro for them.
To aim the workaround right: which add-on version are you on, and what did you put in "Optional On-Prem URL" — the controller URL, or the Events Service URL on 9080?
