Splunk AppDynamics

`distinctcount` used via API returns only 20 results at all times

Enterprise_Data
New Member

When running a query with distinctcount in the UI it works as expected and returns multiple results. But when run via API I only get 20 results no matter the limit:

curl --location --request POST 'https://analytics.api.appdynamics.com/events/query?end=1700243357711&limit=100&start=1700239757711' \
--header 'PRIVATE-TOKEN: glpat-cQefeyVa51vG__mLtqM6' \
--header 'X-Events-API-Key: $API_KEY' \
--header 'X-Events-API-AccountName: $ACCOUNT_NAME' \
--header 'Content-Type: application/vnd.appd.events+json;v=2' \
--header 'Accept: application/vnd.appd.events+json;v=2' \
--header 'Authorization: Basic <bearer>' \
--data-raw '{"query":"SELECT toString(eventTimestamp), segments.node, requestGUID, distinctcount(segments.tier) FROM transactions","mode":"scroll"} 

 result:

[
    {
        "label": "0",
        "fields": [
            {
                "label": "toString(eventTimestamp)",
                "field": "toString(eventTimestamp)",
                "type": "string"
            },
            {
                "label": "segments.node",
                "field": "segments.node",
                "type": "string"
            },
            {
                "label": "requestGUID",
                "field": "requestGUID",
                "type": "string"
            },
            {
                "label": "distinctcount(segments.tier)",
                "field": "segments.tier",
                "type": "integer",
                "aggregation": "distinctcount"
            }
        ],
        "results": [
            [
                "2023-11-17T16:55:14.472Z",
                "node--1",
                "82bbb595-88b7-4e81-9ded-56cb5a42c251",
                1
            ],
            [
                "2023-11-17T16:55:14.472Z",
                "node--7",
                "c7785e77-deb9-4aff-93fe-35efa7299871",
                1
            ],
            [
                "2023-11-17T16:55:22.777Z",
                "node--7",
                "3c22d9dd-74a3-496c-b8b9-1c4ce48a6b1f",
                1
            ],
            [
                "2023-11-17T16:55:22.777Z",
                "node--7",
                "d86e97ff-91c8-45f9-832e-ec6f06ffff26",
                1
            ],
            [
                "2023-11-17T16:55:29.959Z",
                "node--1",
                "44abeb53-30e6-4973-8afb-f7cfc52a9ba7",
                1
            ],
            [
                "2023-11-17T16:55:29.959Z",
                "node--1",
                "b577b0b0-2d41-4dfa-aceb-e42b5bb39348",
                1
            ],
            [
                "2023-11-17T16:56:55.468Z",
                "node--1",
                "2f92e785-8cd0-4028-acd7-21fa794eb004",
                1
            ],
            [
                "2023-11-17T16:56:55.468Z",
                "node--1",
                "af7ca09b-c4fc-4c73-8502-26d92b2b5835",
                1
            ],
            [
                "2023-11-17T16:58:13.694Z",
                "node--1",
                "4a04304b-f48f-4c8d-9034-922077dfcdb4",
                1
            ],
            [
                "2023-11-17T16:58:13.694Z",
                "node--7",
                "22755c60-efa0-434f-be73-0f02f0222021",
                1
            ],
            [
                "2023-11-17T17:00:36.983Z",
                "node--1",
                "b6386249-6408-4517-812c-ca3d5e6c304c",
                1
            ],
            [
                "2023-11-17T17:00:36.983Z",
                "node--1",
                "f7c63152-b569-42bf-8d37-32bb181d7028",
                1
            ],
            [
                "2023-11-17T17:05:50.737Z",
                "node--1",
                "306c7cb3-0eff-440e-96e1-4ad61ce01a0c",
                1
            ],
            [
                "2023-11-17T17:05:50.737Z",
                "node--1",
                "b33c04bd-dfd6-452a-b425-7639dad0422d",
                1
            ],
            [
                "2023-11-17T17:08:24.554Z",
                "node--7",
                "0ed8c3a6-a59c-4fee-a10e-e542c239aa94",
                1
            ],
            [
                "2023-11-17T17:08:24.554Z",
                "node--7",
                "c0e6f198-d388-49da-96a6-d9d95868c40f",
                1
            ],
            [
                "2023-11-17T17:10:06.483Z",
                "node--1",
                "cf3caef6-2688-4eac-a2a1-b2edb55f0569",
                1
            ],
            [
                "2023-11-17T17:10:06.483Z",
                "node--7",
                "40f5a786-e12d-4b0c-a54e-a330e7b7afd1",
                1
            ],
            [
                "2023-11-17T17:11:47.167Z",
                "node--7",
                "02c3a025-6def-499d-9315-68551df639d4",
                1
            ],
            [
                "2023-11-17T17:11:47.167Z",
                "node--7",
                "f19df1e3-983d-4a72-a5e0-a3f9ffbb7afe",
                1
            ]
        ],
        "moreData": true,
        "schema": "biz_txn_v1"
    }
]

image.png

0 Karma
Get Updates on the Splunk Community!

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...