Splunk AppDynamics

ADQL query for work hours only

Daniel_Barbeir1
New Member

Hi,

This is not quite an unusual issue:
I want to do an ADQL query, but limit it to business hours (or rather, in this case, 8 am to 8 pm), as the traffic pattern shifts dramatically in the off-hours. 

The idea would be to have that query run so I could ADQL query metrics for (for example) end-user response time for 8 am to 8 pm every day for the past week.

I've tried where "timestamp between ", but that requires a full date to be set (including the day).

How can I do this?

Labels (1)
0 Karma

Philippe_Thero1
Explorer

You probably need to script this. 

Using REST API, retrieve your metric for Monday 8am-8m, then Tuesday etc.

Aggregate the results to get your weekly value.

To make your life more simple you might want to run this job every day at 8pm and specify a 12 hours time window with the time-range-type=BEFORE_NOW&duration-in-mins=720.

However, to get a precise answer you will need to specify the start and end time stamps. Note that AFAIK the event server wants timestamps in UTC timezone.

example:

SELECT metrics.enduserresponsetime from browser_records where eventTimestamp >= '2022-05-05T08:00:00.000Z' and  eventTimestamp <= '2022-05-05T19:59:59.999Z'

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...