Docs » Welcome

---

Welcome

. Get your data in The first step toward observability is getting relevant data into Observability Cloud. View all supported integrations.

Get data in Learn how to get data in from each layer in your stack Get data into Splunk Observability Cloud

OpenTelemetry Install the Splunk Distribution of the OpenTelemetry Collector Get started with the Splunk Distribution of the OpenTelemetry Collector

Cloud providers Integrate to collect service metrics and logs Connect to your cloud service provider

Back-end apps and services Instrument to collect traces and logs Instrument back-end applications to send spans to Splunk APM

Front-end app user experiences Instrument to collect user sessions Instrument mobile and web applications for Splunk RUM

Serverless functions Instrument to collect traces and logs Instrument serverless functions for Splunk Observability Cloud

. Explore and monitor your environment After you have data coming into Observability Cloud, you can do some exploring.

Infrastructure Monitoring Monitor server and cluster metrics What can I do with Splunk Infrastructure Monitoring?

Application Performance Monitoring Monitor back-end app and service traces What can you do with Splunk APM?

Real User Monitoring Monitor data about front-end app user experiences What can I do with Splunk RUM?

Log Observer Connect Query logs to identify root causes Introduction to Splunk Log Observer Connect

Synthetic Monitoring Proactively monitor the performance of web resources Splunk Synthetic Monitoring

All products Learn more about all Observability Cloud products Welcome to Splunk Observability Cloud

. Set up alerts and customize your account Prepare for issues that might arise by setting up alerts, custom dashboards, and other advanced features.

Detectors and alerts Receive alerts about conditions you care about Create detectors to trigger alerts

Dashboards and charts Get actionable insights about the systems you monitor Dashboards in Splunk Observability Cloud

Span tags Use span tags to add useful metadata to traces Add context to spans with span tags in Splunk APM

Logs pipeline Add value to your raw logs by customizing your pipeline Manage the logs pipeline

Related Content Enable users to seamlessly move across product views Related Content in Splunk Observability Cloud

Global Data Links Provide convenient access to relevant resources Link metadata to related resources using global data links

. Administer your account As an Observability Cloud administrator, use these tools to give your users a secure and relevant user experience.

Get started Learn how to set up and administer your organization Set up and administer Splunk Observability Cloud

Access tokens Authenticate and track API use Create and manage organization access tokens using Splunk Observability Cloud

Users Invite users and set access levels Create and manage users in Splunk Observability Cloud

Teams Create teams to help coordinate teamwork Create and manage teams in Splunk Observability Cloud

Single sign-on Set up an integration to an SSO provider Configure SSO integrations for Splunk Observability Cloud

Subscription usage Monitor subscription usage for Infrastructure Monitoring Monitor and manage subscription usage and billing

. Popular integrations Access documentation for some of the most popular integrations used to get data into Observability Cloud.

Linux Collect metrics and logs Collect Linux data

Kubernetes Collect metrics and logs Collect Kubernetes data

Windows Collect metrics and logs Collect Windows data

Amazon Web Services Collect metrics and logs Connect to AWS and send data to Splunk Observability Cloud

Azure Collect metrics Connect to Azure and send data to Splunk Observability Cloud

Browser Collect user sessions Instrument browser-based web applications for Splunk RUM

.NET Collect traces Instrument .NET applications for Splunk Observability Cloud

Java Collect traces Instrument Java applications for Splunk Observability Cloud

Ruby Collect traces Instrument Ruby applications for Splunk Observability Cloud

Node.js Collect traces Instrument Node.js applications for Splunk Observability Cloud

PHP Collect traces Instrument PHP applications for Splunk Observability Cloud

All supported integrations View a list of all supported integrations Supported integrations

GET STARTED

• Welcome to Splunk Observability Cloud
  • Get data in using supported integrations to hundreds of common data sources
  • Splunk Infrastructure Monitoring
  • Splunk Application Performance Monitoring
  • Splunk Real User Monitoring
  • Splunk Synthetic Monitoring
  • Splunk Log Observer
  • Splunk On-Call
  • Splunk Incident Intelligence
  • Splunk Observability Cloud for Mobile
  • Splunk IT Essentials Work and Splunk IT Service Intelligence
  • Splunk App for Content Packs

• Get started
  • 1. Create a plan and set up your organization
  • 2. Get data into Observability Cloud
  • 3. Explore and analyze your data
  • 4. Set up alerts and customize your experience
  • 5. Create global data links

• Scenarios

• Splunk Observability Cloud and the Splunk platform TOGGLE

• Support
  • Use the Splunk Support Portal
    • Create a Splunk account
    • Submit a Splunk Support Portal case

DATA MANAGEMENT

• Get data into Splunk Observability Cloud
  • Per product integration recommendations
  • 1. Integrate with cloud services to send metrics and logs
    • Steps
    • Troubleshooting
  • 2. Configure servers and clusters to send metrics and logs
    • Steps
    • Troubleshooting
  • 3. Configure third-party server applications to send metrics, logs, and traces
    • Steps
    • Troubleshooting
  • 4. Instrument homegrown applications to send traces, logs, and metrics
    • Steps
    • Troubleshooting
  • 5. Instrument serverless functions to send traces and metrics
    • Steps
    • Troubleshooting
  • 6. Instrument user interfaces to send user sessions
    • Steps
    • Troubleshooting
  • 7. Configure homegrown applications and serverless functions to send custom data
    • Configuration steps for homegrown applications
    • Instrument serverless functions
    • Troubleshooting
  • 8. Use the Observability Cloud API to send custom data
    • Steps
    • Troubleshooting
  • Next steps

• Supported integrations
  • Amazon Web Services
  • Google Cloud Platform services
  • Microsoft Azure services
  • Infrastructure
  • APM instrumentation
  • Metric instrumentation
  • RUM instrumentation
  • Application receivers
  • Community integrations
  • Notification services
  • Login services
  • Data link destinations
  • Other integrations

• Connect to your cloud service provider TOGGLE

• Collect infrastructure metrics and logs TOGGLE

• Instrument back-end services TOGGLE

• Instrument serverless functions TOGGLE

• Instrument front-end applications TOGGLE

• Available host and application monitors TOGGLE

• Splunk Distribution of OpenTelemetry Collector TOGGLE

• Other data ingestion methods
  • Send telemetry using the OpenTelemetry Collector Contrib project
    • Feature comparison
    • Prerequisites
    • Sample configuration for Observability Cloud
    • Migrate to the Splunk Distribution of OpenTelemetry Collector
    • Troubleshooting
  • Send data using REST APIs
    • Start sending data using the API
    • Return codes
  • Send custom metrics to Splunk Observability Cloud
    • Add a receiver for custom metrics
    • Add the required dependencies
    • Send custom metrics
  • Send traces to Splunk Observability Cloud using the gRPC endpoint
    • Send traces using the gRPC endpoint
  • Set the host.name attribute override using the OpenTelemetry Helm chart

• SignalFx Smart Agent (Deprecated) TOGGLE

UNDERSTAND AND ANALYZE YOUR DATA

• Data types in Splunk Observability Cloud
  • Quick overview of Observability Cloud data types
  • Next steps: Tools and analytics

• Metrics, metadata and events TOGGLE

• Data tools TOGGLE

• SignalFlow and analytics TOGGLE

DASHBOARDS AND CHARTS

• Dashboards TOGGLE

• Charts TOGGLE

• Navigate with data links
  • Choose a data link type
    • Configure local data links
    • Select a property value to follow a link
  • More specific data links override less specific data links
  • Local data links override equally specific global data links
  • Default links override non-default links
    • Use and view data links
  • About defining data links

• Override default time range
  • Specify a relative time range
    • Select a time range from the menu
    • Type in a relative time range
  • Specify an absolute time range
  • Pan through time ranges

• Read and write permissions
  • Read permissions for dashboard groups and dashboards
    • Rules for setting read permissions
  • Write permissions
    • Rules for setting write permissions
  • Read and write permissions management

ALERTS AND DETECTORS

• Introduction to alerts and detectors
  • Sample use cases of alerts and detectors
  • Detectors
    • Metadata in detectors
    • Dynamic threshold conditions
  • Alerts
  • Interaction between detectors, events, alerts, and notifications

• Alerts and detectors use case library TOGGLE

• Use and customize AutoDetect alerts and detectors TOGGLE

• Create detectors to trigger alerts
  • Create detectors
  • Choose how to create a detector
    • Clone an existing detector
    • Create a detector from a chart
    • Create a detector from scratch
    • Create a detector using the API
  • Build detector rules
    • Select alert signals
    • Select alert conditions
    • Specify alert settings
    • Alert messages
    • Alert recipients
    • Activate
    • Edit detectors through the SignalFlow tab
  • Name the detector
  • Manage detector rules
  • Set detector permissions

• View and manage permissions for detectors
  • Display a detector permissions list
  • Grant and revoke permissions for detectors
    • Grant write permissions for detectors
    • Revoke write permissions for detectors
  • Detector actions that require write permission

• Link detectors to charts
  • Link a detector to a chart
  • Unlink a detector from a chart
  • View active alerts and linked detectors
    • View active alerts related to a chart
    • View linked detectors on the Detector menu
  • List charts linked to a detector

• Manage notification subscribers
  • Manage subscribers from the Detectors tab
  • Subscribe to alerts using the Detector menu
  • Remove notification recipients from a detector
  • Do more with your notifications

• Preview detector alerts
  • How alert preview works
    • Modify an existing detector based on past activity
    • Create a new detector based on a recent alert
    • Create a new detector based on recent signal values

• View alerts
  • Review all active alerts in your organization
    • Filter alerts to reduce noise
    • Group alerts by properties or dimensions
  • See which alerts are active for a detector
  • Identify alerts from your charts
  • Find which service has active alerts in APM

• View detectors
  • View a list of all detectors
    • View detectors related to a chart or the Infrastructure Navigator
    • View an individual detector

• Mute alert notifications
  • How muting works
  • Create muting rules
    • Mute specific detectors or alerts
    • Create muting rules based on group-by dimensions
    • Create muting rules from scratch
  • Configure your muting rule
  • Search and view muting rules
    • Active and scheduled muting rules
    • Muted notifications
  • Cancel or delete muting rules

• Auto-clear alerts
  • Resolution logic

• Troubleshoot detectors
  • Troubleshoot common detector issues
  • Troubleshoot timestamp issues
  • Troubleshoot correlation conflicts
    • Use the count function to determine whether an instance should be down

• Detector options
  • Show events as lines
  • Show data markers
  • Delay settings
    • Min Delay
    • Max Delay
  • Disable chart display sampling
  • Calendar time zone

• Built-in alert conditions TOGGLE

APM

• Introduction to Splunk APM
  • What is Splunk APM?
  • Get your data into Splunk APM
  • What can you do with Splunk APM?

• Key concepts in Splunk APM
  • Services
    • endpoint
    • environment
    • identity
    • inferred service
    • instrumented service
    • operation
    • service
    • service map
  • Traces and spans
    • Business Workflow
    • indexed span tag
    • span
    • span tag
    • Tag Spotlight
    • trace
    • Trace Analyzer
    • trace view
  • MetricSets
    • cardinality
    • Monitoring MetricSets (MMS)
    • Troubleshooting MetricSets (TMS)

• Scenarios for troubleshooting errors and monitoring application performance using Splunk APM TOGGLE

• Set up Splunk APM TOGGLE

• Manage services, spans, and traces in Splunk APM TOGGLE

• Analyze services with span tags and MetricSets TOGGLE

• Correlate traces to track Business Workflows TOGGLE

• Visualize and alert on your application in Splunk APM TOGGLE

• AlwaysOn Profiling TOGGLE

• Monitor Database Query Performance TOGGLE

• Use Data Links to connect APM properties to relevant resources TOGGLE

INFRASTRUCTURE

• Introduction
  • Splunk Infrastructure Monitoring hierarchy
  • Get started with Splunk Infrastructure Monitoring
  • What can I do with Splunk Infrastructure Monitoring?

• Key concepts
  • Data link
  • Navigator
  • Resolution
  • SignalFlow
  • Virtual metrics

• Quick start tutorial
  • Step 1. Get platform infrastructure data into Splunk Observability Cloud
  • Step 2. Get cloud infrastructure data into Splunk Observability Cloud
  • Step 3: Monitor your platform and cloud infrastructure
  • Step 4. Activate an out-of-the-box detector to issue alerts
  • Next steps

• Set up Infrastructure Monitoring
  • Step 1. Connect cloud services
  • Step 2. Collect infrastructure data with the Splunk Distribution of OpenTelemetry Collector
  • Step 3. Monitor and troubleshoot your infrastructure

• Monitor services and hosts
  • Displayed data: Traffic considerations
    • Navigator considerations

• Use navigators
  • View all navigators
  • Monitor all instances in a navigator
  • Drill down
  • Display related resources or views
  • Use the Dashboard section
  • Customize navigator display
    • Add filter
    • Customize time range
    • Color by
    • Group by
    • Find outliers
  • View dependencies in the navigator sidebar
    • Best practice
    • Navigate to services using the navigator sidebar
  • View alerts using navigators
  • Remove an inactive navigator

• Metrics pipeline management TOGGLE

• Network Explorer TOGGLE

• Virtual metrics
  • About virtual metrics
  • List of virtual metrics
  • Limitations of virtual metrics

• Resolution and data retention
  • Native resolution
  • Rollups, resolution, and data retention policies
    • Rollups
    • Resolution
    • Retention

• Resolution and data retention (DPM)
  • Native resolution
  • Chart data resolution
    • Plots with different resolutions
    • Minimum chart resolution
    • Chart resolution and data retention
  • Resolution and data retention policies

LOG OBSERVER

• Splunk Log Observer Connect TOGGLE

• Splunk Log Observer TOGGLE

RUM

• Introduction to Splunk RUM
  • What is Splunk RUM?
  • What can I do with Splunk RUM?
  • (Optional) Link RUM spans to APM spans
  • Get data in

• Key concepts in Splunk RUM
  • Session
  • Session ID
  • Spans
    • Spans in Splunk RUM for Browser
    • Spans in Splunk RUM for Mobile
  • Trace
    • Browser trace
    • Back-end trace
  • User sessions
  • Span ID
  • Tag
  • RUM metrics for mobile applications
    • App start
    • App crashes and errors
    • Presentation transition
  • RUM metrics for browser applications
    • Web vitals
    • Errors
  • Error ID
  • Custom events
  • Built-in dashboards
  • Global attributes

• Splunk RUM use case library TOGGLE

• Set up Splunk RUM
  • Generate your RUM access token in Observability Cloud
  • Get data in
  • Check that your data is coming in
  • Learn about the types of data RUM collects

• Use controls for sensitive data in Splunk RUM
  • What is sensitive data ?
  • Splunk RUM for Browser instrumentation
    • Examples
  • Splunk RUM for Mobile Android instrumentation
    • Examples
  • Splunk RUM for mobile iOS instrumentation
    • Examples
  • See also

• Data collected by Splunk RUM
  • Platform-specific RUM data

• Create custom events
  • How custom events can add value to your organization
    • Use case
  • Create a custom event
  • Advanced configurations

• Error monitoring and crash aggregation in Tag spotlight
  • Mobile crash aggregation
    • Explore top crashes across in Tag Spotlight
  • JavaScript error aggregation
    • Find the top JavaScript errors across your applications in Tag Spotlight
    • JS Errors without stacktrace, type, or message
  • Learn more

• Filter your data by tags in Splunk RUM
  • Understand the results of your search
    • Apply multiple filters under the same operator
    • Apply separate filters
  • Search for global attributes
    • How to set global attributes
    • Global attributes examples
    • Span attributes example
  • Search for unindexed tags
  • Undefined tag values
  • Search for indexed tags
  • Why are some tag values undefined?
  • Examples on how to filter by tags
    • Search by status code
    • Search for a specific browser version
    • Include all results or exclude all results

• Write custom rules for URL grouping in Splunk RUM
  • What are custom rules in Splunk RUM?
  • Write a custom rule
  • How to identify components of a URL
    • Example
  • How to identify tokens
    • Domain
    • Path
    • Support for # in URLs
  • Pattern syntax
    • What is a rule?
    • What is a pattern?
    • <?> Wildcard for single token
    • <??> Wildcard for one or more trailing tokens
    • Combination pattern
  • Invalid syntax
  • Default rules
    • Example
    • Example
  • Use cases
    • Use a <?> wildcard to group URLs by product ID
    • Use a <?> wildcard to group by subdomain
    • Use a <??> wildcard to group by string
  • Manage URL grouping rules
    • Create a new rule
    • Edit an existing rule
    • Deactivate or reactivate a rule
    • Delete

• Alert on Splunk RUM data
  • How alerts work in Splunk RUM
    • Integrations
    • Data retention
  • Types of metrics you can alert on
  • Alert configuration examples
    • Alert trigger conditions
    • Page level metrics
    • App level metrics
    • URL level metrics
  • Create a detector
  • Create dashboards for your RUM alerts
  • View detectors and alerts

• Splunk RUM dashboards TOGGLE

• Splunk RUM metrics reference
  • Aggregates versus page level metrics
  • Custom event metrics
  • Learn more

• Experiment with the demo applications for Splunk RUM for Mobile
  • Android demo app
  • iOS demo app

• Third-party software

SYNTHETICS

• Introduction to Splunk Synthetic Monitoring
  • How does Splunk Synthetic Monitoring work?
  • Use cases for Splunk Synthetic Monitoring
  • Create your first test with Splunk Synthetic Monitoring

• Key concepts in Splunk Synthetic Monitoring
  • Learn more

• Synthetics use case library TOGGLE
  • Scenario: Kai monitors a multi-step workflow
    • Set up a Browser test to monitor a critical workflow
    • Learn more
  • Scenario: Kai monitors API performance for a critical workflow
    • Monitor API performance for a checkout workflow
    • Learn more about API tests
  • Scenario: Kai monitors the performance of a user-facing application
    • Set an Uptime test to monitor a mobile app endpoint
    • Learn more

• Set up Splunk Synthetic Monitoring
  • Get started
  • Set up your first Uptime test
    • Learn more about Uptime tests
  • Set up your first Browser test
    • Learn more about Browser tests
  • (Optional) Link Synthetic spans to APM spans
  • (Optional) Integrate with Splunk RUM
  • (Optional) Configure your application
  • Continue learning

• Use a browser test to test a webpage TOGGLE
  • Set up a Browser test
    • Set up a Browser test
    • View your Browser test
    • Interpret your Browser test results
    • Edit your Browser test
    • Advanced settings for Browser tests
    • Example
  • Add synthetic transactions to your Browser Test
    • What are synthetic transactions?
    • What are steps?
    • Add synthetic transactions to your Browser Test
  • Interpret Browser Test results
    • View Browser test history
    • Interpret Browser test run results
  • Browser test metrics
    • Metrics for Browser tests
    • Detect and report on your synthetic metrics

• Use an Uptime Test to test port or HTTP uptime TOGGLE
  • Set up an Uptime test
    • Configure an HTTP Uptime test
    • Configure a Port Uptime test
    • View your Uptime test
    • Interpret your Uptime test results
    • Advanced settings for uptime tests
    • Example
  • Interpret Uptime test results
    • View Uptime test history
    • Interpret Uptime test run results
    • Uptime test metrics

• Use an API Test to test an endpoint TOGGLE
  • Set up an API test
    • Set up an API test
    • Example
  • Interpret API test results
    • View API test history
    • Interpret API test run results
  • API test metrics
    • Dimensions
    • Request level metrics
    • Run-level metrics

• Configure your tests TOGGLE
  • Configure your site to accommodate synthetic tests
    • Allow Splunk Synthetic Monitoring IP addresses
    • Exclude Splunk Synthetic Monitoring from analytics
  • Set up detectors and alerts in Splunk Synthetic Monitoring
    • Use cases for detectors in Synthetics
    • Set up a detector for a Splunk Synthetic Monitoring test
  • Built-in variables to use in tests
    • Random variables
    • Date-and-time variables
    • Location variables
    • Request variables for API Tests
    • Use a variable in a test
  • Create and use Global Variables
    • How can you use global variables?
    • What happens when you conceal a global variable?
    • Prerequisites
    • Create a global variable
    • Edit a Global Variable
    • Use a global variable in a synthetic test
  • Public locations
  • Private locations
    • What is a runner?
    • Use cases for private locations
    • Requirements
    • Set up a new private location
    • Assess the health of your private location
  • Splunk RUM metrics integration
    • Prerequisites
    • View web vitals for your run results
    • Compare latency of a test by run location
    • See also
  • Validate your test configuration with try now
    • When to run a test or use try now to validate your test configuration

INCIDENT INTELLIGENCE

• Introduction to Splunk Incident Intelligence
  • How Incident Intelligence works
  • How Incident Intelligence fits into Splunk Observability Cloud
  • Get started with Incident Intelligence
  • What can I do with Incident Intelligence?
  • How to provide feedback or get help

• Splunk Incident Intelligence overview
  • Typical alert generation creates alert noise
  • Incident policies route and group alerts into incidents that trigger workflows
  • Responders are notified when a triggered incident workflow routes to an on-call schedule
  • End-to-end incident response process

• Key concepts in Splunk Incident Intelligence

• Set up Incident Intelligence
  • Prerequisite
  • Get started

• Ingest alerts in Incident Intelligence TOGGLE

• Create and configure incident policies
  • Create an incident policy
  • Delete an incident policy
  • Configure the alerts routed to your incident policy
  • Configure how alerts are grouped
  • Configure incident workflows for your incident policy
  • Rank your incident policies to ensure alerts are appropriately routed
  • Mute notifications using incident policy maintenance
    • Take an incident policy out of maintenance
  • Next step

• Create and manage on-call schedules TOGGLE

• Respond to and manage incidents TOGGLE

• Manage notifications from Incident Intelligence TOGGLE

MOBILE

• Introduction to Splunk Observability Cloud for Mobile
  • Get started with Splunk Observability Cloud for Mobile
  • What can I do with Splunk Observability Cloud for Mobile?

• Download the app
  • Requirements
    • iOS requirements
    • Android requirements
  • Download Splunk Observability for Mobile from the App Store
  • Download Splunk Observability for Mobile from the Google Play store
  • User Authentication in Splunk Observability for Mobile

• View dashboards and alerts
  • View dashboards using Splunk Observability Cloud for Mobile
    • View and search dashboards
  • View alerts using Splunk Observability for Mobile
    • View alerts
    • Share alerts

• Set your on-call notification preferences

ADMINISTER OBSERVABILITY CLOUD

• Set up and administer Splunk Observability Cloud
  • Set up and administer your organization

• Scenario: Wei maintains a secure organization with many teams and users using Splunk Observability Cloud
  • Enhance team security with access restrictions and tokens
    • Learn more
  • Limit who can edit a detector
    • Learn more
  • Prevent people on other teams from viewing and changing your dashboards
    • Learn more
  • Summary

• Create and manage authentication tokens TOGGLE

• Create and manage users
  • Add users to the organization
  • Remove users from the organization
  • Grant and revoke administrative access
  • Request administrative access
  • Look up when a user logged in
  • Address a locked user account

• Create and manage teams TOGGLE

• View organization metrics
  • Access organization metrics
  • Interpret and work with org metrics
    • Metrics for values by token
    • Metrics with values for each metric type
    • A metric that counts stopped detectors
    • Metrics that track system limits
    • Authentication error metrics
    • Compare gross and num metric values
  • Metric details
  • Get help

• Monitor subscription usage and billing TOGGLE

SETTINGS AND REFERENCE

• Password and contact information

• Organizations

• Teams

• Time zone and color accessibility settings
  • Change time zone or color accessibility settings

• API access token

• Supported browsers

• Third-party software credits

• Data retention
  • Data retention in Infrastructure Monitoring
  • Data retention in Real User Monitoring (RUM)
  • Data retention in Application Performance Monitoring (APM)
  • Data retention in Log Observer
  • Data retention in Splunk On-Call
  • Data retention in Splunk Synthetic Monitoring

• Per product system limits

• Glossary
  • A
  • C
  • D
  • E
  • F
  • G
  • I
  • M
  • N
  • P
  • R
  • S
  • T

---

Next

Welcome to Splunk Observability Cloud

❯

---

• API docs
• Blog
• Training
• Free Trial