Splunk AppDynamics

Create search from custom timer events (mobile app)

Nabiilah_Fasih
New Member

Hello,

We have some custom timers in the code, and I wanted to create a search based on the timer name.

This is what I did:

SELECT timer FROM mobile_session_records WHERE timer.timername is not null AND timer.timername = "SaveItem"

However, the result is not filtering properly by timername. It is showing me entries for other timer names.

Then I tried this:

SELECT timer.timername FROM mobile_session_records WHERE timer.timername is not null AND timer.timername = "SaveItem"

And it looks like timer name is an array with a bunch of timer events in it, which is strange. This is an example of the response I got:

["SaveItem"]

["LoadItem", "SaveItem"]

["Login", "SaveItem"]

Why does timer name contain multiple timer events?

Has anyone tried to create searches based on custom timers? How did you do it?

Labels (1)
0 Karma

Aditi_Sharma
Explorer

Hello @Nabiilah.Fasih

Since its a list of timer values you could try a query such as SELECT timer FROM mobile_session_records WHERE timer.timername IN ("SaveItem") 

As for where there are multiple timer names - it is because for that particular user session record - multiple timer events occurred.

Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...