Splunk AppDynamics

ADQL query for work hours only

Daniel_Barbeir1
New Member

Hi,

This is not quite an unusual issue:
I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. 

The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week.

I've tried where "timestamp between ", but that requires a full date to be set (including the day).

How can I do this?

Labels (1)
0 Karma

Philippe_Thero1
Explorer

You probably need to script this. 

Using REST API, retrieve your metric for Monday 8am-8m, then Tuesday etc.

Aggregate the results to get your weekly value.

To make your life more simple you might want to run this job every day at 8pm and specify a 12 hours time window with the time-range-type=BEFORE_NOW&duration-in-mins=720.

However, to get a precise answer you will need to specify the start and end time stamps. Note that AFAIK the event server wants timestamps in UTC timezone.

example:

SELECT metrics.enduserresponsetime from browser_records where eventTimestamp >= '2022-05-05T08:00:00.000Z' and  eventTimestamp <= '2022-05-05T19:59:59.999Z'

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...