Creating custom metrics for ADQL query for monitoring Intune connectors

[Uma.Boppana]

1] Tried using Until since to pull the no of days between the expirationDateTime and system date, based on token name as we have many token names

expirationDateTime	eventTimestamp	pickupTimestamp
2025-07-26T23:00:03+05:30	2024-11-21T17:06:33+05:30	2024-11-21T17:06:33+05:30

Token name

AppD

can you suggest the query to be used such that we get value in no of days the certificate gets expired

[Mario.Morelli]

I am assuming due to the way the query is being evaluated, it doesn't just take latest value, and hence due to using max, it gets the largest value stored of that field for however long you store data in analytics.

You can either try and change the max to min which should get the lowest value always but better would be to append the following clause to the query to ensure that only the last 5 minutes of data gets used to get the value - SINCE 5 minutes

[Uma.Boppana]

Hi Mario,

Thanks for the update. Since its not creating updated values, we have applied formula at power automate itself.

Now issues is 

    "type": "string",
        "value": "abcd@ef.gh.com"

 value ""abcd@ef.gh.com""not poping up  under AppD schem , though the value is getting parsed.

I have initiated as string and earlier it worked , once i have deleted schema and created again, value showing as null

[Mario.Morelli]

Hi Uma

What do you mean the value is not getting updated, if you run the query in the query browser does it return the correct value? Is it only in the calculated metric where it doesn't return the correct value?

[Uma.Boppana]

I am pushing values from power automate to appd schema.

All values getting captured under APPd schema but not AppleId which is email ID which i defined as string

here appleId value is null

why is it not capturing the value

[Mario.Morelli]

That's strange

Can you run the query "select appleid from intune_vpp1"  does it show null values as well? Also double click on any of the events and check if the email value is shown there in the popup screen or are they all null?

I know some characters cause the main view to show null event though there is a value in them, have not populated it with an email address, will do a test on my side as well

[Uma.Boppana]

Its null. even if i click on event it shows Null value

[Mario.Morelli]

Hi, I believe the problem is not on AppDynamics side. I just tested and inserted an email address into the string field and it shows correctly

Here is my sample Curl populating the data, which works. Can you try and manually post to analytics and see if it works, might be power automate which doesn't format the email address correctly perhaps?

curl -X POST "https://xxxxxxx/events/publish/TEST" -H "X-Events-API-AccountName:xxxxxxxx" -H "X-Events-API-Key:xxxxxx" -H "Content-type: application/vnd.appd.events+json;v=2" -d '[{"expirationDateTime": 1597135561333, "appleId": "test@test.com", "DaysLeft": "176"}]'