Splunk AppDynamics

ADQL query for work hours only

Daniel_Barbeir1
New Member

Hi,

This is not quite an unusual issue:
I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. 

The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week.

I've tried where "timestamp between ", but that requires a full date to be set (including the day).

How can I do this?

Labels (1)
0 Karma

Philippe_Thero1
Explorer

You probably need to script this. 

Using REST API, retrieve your metric for Monday 8am-8m, then Tuesday etc.

Aggregate the results to get your weekly value.

To make your life more simple you might want to run this job every day at 8pm and specify a 12 hours time window with the time-range-type=BEFORE_NOW&duration-in-mins=720.

However, to get a precise answer you will need to specify the start and end time stamps. Note that AFAIK the event server wants timestamps in UTC timezone.

example:

SELECT metrics.enduserresponsetime from browser_records where eventTimestamp >= '2022-05-05T08:00:00.000Z' and  eventTimestamp <= '2022-05-05T19:59:59.999Z'

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...