Splunk AppDynamics

Availability report from synthetic jobs Group by or aggregrate Daily

CommunityUser
Splunk Employee
Splunk Employee

Hi Team,

I'm a newbie to AppDynamics trying to generate a custom dashboard and Report. Right now, my synthetic Job runs for every 5mins and i would like to generate the Availability report from the job result success/failure aggregated per day. I was able to generate a report with ADQL 

SELECT toString(eventTimestamp, "MM-dd-yyyy") AS 'DATE', avg(metrics.`Availability (ppm)`)/10000 AS 'Availability %' FROM synth_session_records WHERE measurementSpec.scheduleName = 'JOB-NAME' 

But the date is shown in UTC timezone. The initial "eventTimestamp" is properly shown in PST but after doing the string conversion it is getting converted to UTC and the overall availability report shows incorrect percentage. 

I've tried to use the series functions to group the metrics but the resultant table has timestamp in the date column (i just need the MM-DD-YYYY date format and no any time in the tabular forum)

SELECT series(eventTimestamp, '1d') AS 'Date', avg(metrics.`Availability (ppm)`)/10000 AS 'Availability %' FROM synth_session_records WHERE measurementSpec.scheduleName = 'JOB-NAME' 

Output from the series query:

Date                                           Availability %

-------------------------------------------------------------

8/31/19 9:12:02 PM               85.58

9/1/19 9:12:02 PM                 90.12

9/2/19 9:12:02 PM                 84.92

Anythoughts on how i can aggregate the availability report per day with the proper timezone. 

Labels (1)
0 Karma
1 Solution

jeremyGoldstein
Path Finder

I'm also a novice.

Here's what I came up with. This subtracts 7 hours from the UTC time given by eventTimestamp.

Hope it helps!

tostring(eventTimestamp - toDate("7","H"), "MM/dd/yy h:mm a")

View solution in original post

Tags (2)

jeremyGoldstein
Path Finder

I'm also a novice.

Here's what I came up with. This subtracts 7 hours from the UTC time given by eventTimestamp.

Hope it helps!

tostring(eventTimestamp - toDate("7","H"), "MM/dd/yy h:mm a")
Tags (2)

CommunityUser
Splunk Employee
Splunk Employee

This workaround helped me, although it is not the complete solution it can serve the purpose for now. When there is a daylight saving time, we need to change the difference in hours from 7 to 8.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...