Splunk AppDynamics

Data Colllectors only when value present

Sean_Davey
Path Finder

hi

Has anyone every tried to set up their data collectors so that it only displays when values are present or how did you work your analytic queries to show this.  We have a search form with several different fields that can be used...ie data range, ID, payment method etc.  We want to be able to trend what performance is like when the different searches are used.  The only way I have been able to do this is to have a bunch of different searchs where I list out each data collector is not null.  Is this the best way to get this done?  Has anyone had any luck with this?

Labels (1)
0 Karma
1 Solution

Sean_Davey
Path Finder

What I am looking to do is pull out the field name that is in bold below.    I dont care about the input data just the field name, but like i stated this could be one of 10 possible inputs.  

<MembershipSearchInput inSyncReferenceResolution="false" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
<maxRows>1</maxRows>
<membershipIdentifier>123456</membershipIdentifier>
<sortBy>
<SortColumn>
<columnName>conceptFulfilledCode</columnName>
<isDescending>false</isDescending>
</SortColumn>

View solution in original post

Morelz
Builder

Hi Sean

If you are referring to MIDC's, you can use the "match condition" option to set something like where a certain value is not null.

This will then only collect the data collector when it has a value.

If it is for headers/params etc. You would need to understand which of them are used for which BT's and set them exclusively to avoid them trying to be collected where there are no values.

I believe within the analytics query, the null values are removed for all widgets except the table widget

Ciao

0 Karma

Sean_Davey
Path Finder

Hi Mario

What would that look like?  Would that only pick up those transactions which meet that criteria?

Thanks

0 Karma

Sean_Davey
Path Finder

What I am looking to do is pull out the field name that is in bold below.    I dont care about the input data just the field name, but like i stated this could be one of 10 possible inputs.  

<MembershipSearchInput inSyncReferenceResolution="false" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
<maxRows>1</maxRows>
<membershipIdentifier>123456</membershipIdentifier>
<sortBy>
<SortColumn>
<columnName>conceptFulfilledCode</columnName>
<isDescending>false</isDescending>
</SortColumn>

Morelz
Builder

Hi Sean

Just a question, what does the xml look like for the different searches? is it always prefixed by the maxrows line?, and only the value changes e.g membershipIdentifier or paymentMethod etc.

<MembershipSearchInput inSyncReferenceResolution="false" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
<maxRows>1</maxRows>
<membershipIdentifier>123456</membershipIdentifier>
<sortBy>
<SortColumn>
<columnName>conceptFulfilledCode</columnName>
<isDescending>false</isDescending>
</SortColumn>

If only the field name changes depending on the search, you can just use a single data collector like below

toString().split(</maxRows>).[1].split(<).[1].split(>).[0]

This will capture whichever value is then in that spot, but depends on what the other search xml looks like if this will work.

The other way would be to setup a single data collector for each value that it can be, with a match condition where the payload contains the "search value", and set the data collector field name the same for each Data collector per search. 

This will then happen, e.g if the payload is as follows

<MembershipSearchInput inSyncReferenceResolution="false" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" >
<maxRows>1</maxRows>
<paymentmethod>card</membershipIdentifier>
<sortBy>
<SortColumn>
<columnName>conceptFulfilledCode</columnName>
<isDescending>false</isDescending>
</SortColumn>

Only the Data Collector with the match condition where payload contains "paymentmethod" will trigger and set the Type to that value

I hope I understood what you are trying to achieve:)

Ciao

Sean_Davey
Path Finder

This was awesome and worked great!!!

0 Karma
Get Updates on the Splunk Community!

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products   Security Edition   Have you ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Tune in to What’s New in Splunk Enterprise ...