Splunk AppDynamics

ADQL query for work hours only

Daniel_Barbeir1
New Member

Hi,

This is not quite an unusual issue:
I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. 

The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week.

I've tried where "timestamp between ", but that requires a full date to be set (including the day).

How can I do this?

Labels (1)
0 Karma

Philippe_Thero1
Explorer

You probably need to script this. 

Using REST API, retrieve your metric for Monday 8am-8m, then Tuesday etc.

Aggregate the results to get your weekly value.

To make your life more simple you might want to run this job every day at 8pm and specify a 12 hours time window with the time-range-type=BEFORE_NOW&duration-in-mins=720.

However, to get a precise answer you will need to specify the start and end time stamps. Note that AFAIK the event server wants timestamps in UTC timezone.

example:

SELECT metrics.enduserresponsetime from browser_records where eventTimestamp >= '2022-05-05T08:00:00.000Z' and  eventTimestamp <= '2022-05-05T19:59:59.999Z'

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...