Splunk AppDynamics

How to display WCF operation name which is hidden by a custom detection rule

CommunityUser
Splunk Employee
Splunk Employee

Anybody knows how to find out what is the actual WCF operation name, when we have a custom detection rule which groups a bunch of operations together if they are a part of the same service?

For instance, let's say we have WCF service called appd. It has a bunch of operations called op1, op2... Automatic rule will create a single BT for each of the operations and name them like "appd.op1", "appd.op2" etc.

If we create a custom detection rule to include all of them in a single BT, we will end up with a single BT that will, say, have a name "appd operations".

Here comes the issue now. After this new, single BT is created, I am not able to again see the operation names. Cannot find that possibility. I would like to somehow display these op1, op2... and so on... names so I can check few things. Tried in snapshots, look everywhere, it looks like the only way to again fetch these operation names is to delete the custom rule and revert back to auto detection rule.

Any ideas?

Labels (1)
0 Karma
1 Solution

Morelz
Motivator

Hi Bojan

Would it not be better to leave the Business Transaction as a single transaction, and then split out each operation under Service Endpoints?

That way if you are looking for specific operations, you can use Service Endpoints view, which will give you snapshots from within Business Truncations?

Otherwise you would just need to identify where in the Dotnet Code you can extract the operation name for a Data Collector

View solution in original post

Morelz
Motivator

Hi Bojan

Would it not be better to leave the Business Transaction as a single transaction, and then split out each operation under Service Endpoints?

That way if you are looking for specific operations, you can use Service Endpoints view, which will give you snapshots from within Business Truncations?

Otherwise you would just need to identify where in the Dotnet Code you can extract the operation name for a Data Collector

CommunityUser
Splunk Employee
Splunk Employee

Yeah that makes sense indeed. If I don't have too many WCF operations (and I don't in my case) this would really work. Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...