Splunk AppDynamics

When using a Custom Metric event it does not contain the node name

CommunityUser
Splunk Employee
Splunk Employee

Hi,

I'm using Server Agent 4.3.5.7


I have a Health rule that monitors a Custom Metric condition. I am monitoring a process name, triggering an event when the process count exceeds a threshold.

I am forwarding this event to a webhook via an HTTP action request using a JSON payload.

However, the resulting event does not contain the node/server name.

I can see in the AppDynamics Servers Events list the Server name field is not populated.

Is this expected behavior...or can an agent be configured to include the Server name?

Thanks

John

example payload

{
        "controllerUrl": "https://mycontroller.appdynamics.com",
        "accountId": "xxx",
        "accountName": "xxxxxxxxxx",
        "policy": "AUTO_appd_process_Alive",
        "action": "Tell_CSIT_AUTO",
        "topSeverity": "ERROR",
        "eventType": "POLICY_OPEN_CRITICAL",
        "eventId": "1549490534",
        "eventGuid": "16f35995-5d7f-439d-822e-1ae34ea02cf6",
        "displayName": "New Critical Health Rule Violation",
        "eventTime": "Mon Sep 11 09:06:55 PDT 2017",
        "severity": "ERROR",
        "applicationName": "Server & Infrastructure Monitoring",
        "applicationId": "3579",
        "tier": "${latestEvent.tier.name}",
        "node": "${latestEvent.node.name}",
        "healthRule": "Auto_appd_process",
        "incident": "Auto_appd_process",
        "affectedEntities": [{
                "entityType": "APPLICATION",
                "name": "Server & Infrastructure Monitoring"
            }
        ],
        "deepLink": "https://mycontroller.appdynamics.com/#location=APP_EVENT_VIEWER_MODAL&eventSummary=1549490534&applic...",
        "summaryMessage": "AppDynamics has detected a problem with Application <b>Server &amp; Infrastructure Monitoring</b>.<br><b>Auto_appd_process</b> started violating and is now <b>critical</b>.",
        "eventMessage": "AppDynamics has detected a problem with Application <b>Server &amp; Infrastructure Monitoring</b>.<br><b>Auto_appd_process</b> started violating and is now <b>critical</b>.<br>All of the following conditions were found to be violating<br>For Application <b>Server &amp; Infrastructure Monitoring</b>:<br>1) condition 1<br><b>Count's</b> value <b>1.0</b> was <b>greater than</b> the threshold <b>0.0</b> for the last <b>1</b> minutes<br>",
        "healthRuleEvent": true,
        "healthRuleViolationEvent": true,
        "btPerformanceEvent": false,
        "eventTypeKey": "Health Rule"
    }

Labels (1)
0 Karma
1 Solution

CommunityUser
Splunk Employee
Splunk Employee

Jusy in case anybody else sees this issue

I missed a step in setting up the HR.

Under Affected notice a tick box (looks greyed out and unavailable to me)

You are then presented with the pull down to select the affecked host

View solution in original post

iamryan
Community Manager
Community Manager

Hi @Pranaychandra.Ravi,

Awesome, thanks for sharing! 

0 Karma

Pranaychandra_R
Explorer

@Ryan.Paredez 

This issue is solved with the support help, they enabled the debug and got me the exact error .

I removed the section of the request that are causing the issues 

#set($summaryMessageParts = $latestEvent.summaryMessage.split("Properties"))
#set($summaryMessageFirstPart = $summaryMessageParts[0].trim())

iamryan
Community Manager
Community Manager

Hi @Pranaychandra.Ravi,

Given how old this post is, it may not get a reply from the Community. You can always reach out to Cisco AppDynamics Support - How do I submit a Support ticket? An FAQ 

0 Karma

Pranaychandra_R
Explorer

I am dealing with a similar issue 

we use an HTTP template that works for the health rule-based events to call Webex and Opsgenie but it won't work for custom events. It is failing with the 400 error.

At this point my theory is the template variable exposed by the custom event and the health rule-based event are not the same and as a result, the HTTP template used for the health rule-based event is not working for the custom event

any thoughts?

0 Karma

Atyuha_Pal
Contributor

Hi John,

We can see you have raised a support ticket for the above issue. We will update in support ticket.

Thanks,

Atyuha

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Jusy in case anybody else sees this issue

I missed a step in setting up the HR.

Under Affected notice a tick box (looks greyed out and unavailable to me)

You are then presented with the pull down to select the affecked host

CommunityUser
Splunk Employee
Splunk Employee

Hi Team,

Even in my case, The same Email template works for few applications where as it is not resolving node name for one of the application.

Please let me know if you have solution.

Thanks

Lalitha

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...