Splunk AppDynamics

How to get report/list of custom user data values

CommunityUser
Splunk Employee
Splunk Employee

I have an iOS app that is setting custom user data.  On the sessions, I can see the session records contain that custom data value (which happens to be an integer).   What I'd like to be able to see is a list of unique values.  As there is a limit to the number of sessions I can view, I don't want to actually view all the session records but do the equivalent of  "select distinct(field) from sessions".    I don't see any way to display a custom user data value in a report or dashboard.

Labels (1)
Tags (2)
0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hello Brian,

Thanks for reaching out on the AppDynamics Community. I am the Product Manager for ADQL and the Events Service (which ADQL ultimately ends up querying against).

From your question, it sounds like there are two things you might be seeking two do:

  1. View all unique values for the respective field (say that field is responseTime, since it's numeric)
  2. View the cardinality of that field

Case 1: View all unique values for the respective field

You can view all the unique values for the respective field as such:

SELECT distinct responseTime FROM transactions LIMIT 10000

Note that you can't use braces (I stumbled over this as well when I crafted this response, and it seems you may have encountered the same issue) in older Controller versions, but we fixed this limitation in the newest Controllers (which now work with braces as well.)

Case 2: View the cardinality of a field

In this case, you'd want to issue a query like such:

SELECT distinctcount(responseTime) FROM transactions LIMIT 10000

This query will give you the cardinality of the numeric field, i.e. how many *unique* values exist in the Events Service over the specific time period.

I hope this helps - please don't hesitate to reach out again on this thread should you require any further assistance.

Happy ADQL-ing,

Stefan

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...