Splunk AppDynamics

ADQL query for work hours only

Daniel_Barbeir1
New Member

Hi,

This is not quite an unusual issue:
I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. 

The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week.

I've tried where "timestamp between ", but that requires a full date to be set (including the day).

How can I do this?

Labels (1)
0 Karma

Philippe_Thero1
Explorer

You probably need to script this. 

Using REST API, retrieve your metric for Monday 8am-8m, then Tuesday etc.

Aggregate the results to get your weekly value.

To make your life more simple you might want to run this job every day at 8pm and specify a 12 hours time window with the time-range-type=BEFORE_NOW&duration-in-mins=720.

However, to get a precise answer you will need to specify the start and end time stamps. Note that AFAIK the event server wants timestamps in UTC timezone.

example:

SELECT metrics.enduserresponsetime from browser_records where eventTimestamp >= '2022-05-05T08:00:00.000Z' and  eventTimestamp <= '2022-05-05T19:59:59.999Z'

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...