Splunk AppDynamics

Analytics Query Total Page #

CommunityUser
Splunk Employee
Splunk Employee

Hello,

I have been testing out our analytics feature and am having a problem. I’m trying to fetch a list of the top 20 EUM applications based on the total # of page requests outside of the U.S. for a duration of one year. I have figured out how to narrow the search to only include geocountries but the numbers seemed incorrect. So, I simply tried to query one application and try to identify the total # of page requests for all locations to see if it matched the Page Requests box listed in the AppDy UI. The numbers did not match, as the UI reports 0.91m and the query only counts 4731. I checked my data metrics retention and it is set to 365 days. Does anyone have any advice on why the numbers would be different?

The logic behind the query was that I know every time someone hits a website; the entry should be logged under “browser_records”. And every time they would click on a different page of that site, a new entry should be created. So, I figured I could just sum up all of the entries where the appkey was the same, by using their modified groupby where it automatically buckets values to obtain the total page request #. It seems that the table is not retaining all the entries.

Thought it was due to return limits but its only returning 20 items, so technically the query should be taking place on the events servers.

Any advice is appreciated. image.pngimage.png

Labels (1)

Brian_Wheeldon
Contributor

Hi Wesley,

Please keep in mind that the Analytic Events have a short shelf life. They are normally purged after two weeks, so I would expect your Analytics Query to return the same result whether 2 weeks, or 2 months, or one year is queried.

Rather than use an Analytics Query, your best bet is to use the metrics visible in the Metric Browser to do this calculation. These metrics are calculated from the Events every minute, and are aggregated and persisted for a year by default.

An example Metric Path is:

End User Experience|Geo|United Kingdom|Page Requests per Minute

Use the REST API to fetch the "Sum" of this metric over the one year period for your calculation.

Regards,

Michael_Perlst1
Engager

Great point @Brian.Wheeldon !

Assuming event retention is taken into consideration you might try an ADQL query like below @Anonymous 

SELECT appkey,
geocountry AS "GEO",
count(*) AS "CT"
FROM browser_records
WHERE
geocountry != "United States"
ORDER BY appkey DESC, GEO DESC, CT DESC
LIMIT 1000, 1000, 1000
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...