RUM Browser data model π
The Browser RUM agent collects general RUM telemetry data about your front-end web application, as well as data from several instrumentations.
Common data types π
The Splunk RUM data model represents the following logical entities, following OpenTelemetry conventions:
Trace |
A set of events triggered as a result of a single logical operation, distributed across various components of an application. Traces contain events that cross process, network, and security boundaries. A RUM trace can, for example, initiate when someone taps on a button to start an action on a website. If you use RUM and APM together, traces represent calls made between the downstream services that handle the requests initiated by the user action. |
Span |
An operation within a transaction. A single span includes the logical name, the start and end timestamp of the operation, and the events and attributes linked to the captured data. A span might have a reference to its parent span and zero or more causally-related spans. Spans have universal attributes and custom attributes. |
Session |
A collection of traces that correspond to the actions a single user takes when interacting with an application over a period of time. By default, a session lasts until 15 minutes passed from the last event captured in the session. The maximum session duration is 4 hours. |
Interaction |
Reflects the action the user conducts within the user interface. Common interaction types include mouse clicks, taps on a touch screen, and keyboard events. |
User |
By default, Splunk RUM doesnβt collect identity data. Mapping a trace to a specific user requires manual instrumentation. Users can be represented by their username, email addresses, or using a synthetic identifier. Synthetic representation is useful in situations where PII regulations do not allow users to be identified. |
Basic properties π
The following properties are common to all web applications instrumented for Splunk RUM:
Name |
Type |
Description |
---|---|---|
|
String |
Unique 64-bit identifier generated for the span within the trace. |
|
String |
Parent span ID. Absent if the span is the root span in a trace. |
|
String |
Logical operation the span represents. For example, |
|
Number |
Duration in microseconds. |
|
String |
Unique 128-bit identifier, set on all spans belonging to the trace. |
|
Number |
Epoch microseconds of the start of the span. Can be absent if incomplete. |
|
Object |
Additional context, allowing to search and analyze spans based on specific tags. |
|
Array |
Associates events that explain latency with the time they happened. |
Metrics π
The following tables list all of the metrics available in Splunk RUM for Browser. All errors in Splunk RUM have the dimension sf_error=true
. Metrics with the prefix rum.node.
are page level metrics, whereas metrics with the prefix rum.
are aggregations of multiple pages. Page level metrics also have a dimension sf_node_name
, which you can use to filter on specific pages. Also, page level metrics are captured only if custom URL grouping rules are configured.
App level metric name |
UI name |
Page level metric |
Description |
---|---|---|---|
|
Custom event count |
|
The total number of spans with the selected custom event in the given time range. |
|
Custom event duration |
|
The p75 time in nanoseconds of spans with the selected custom event in the given time range. |
|
Page views and route changes |
|
The total number of page views and route changes sorted by page for the given time range. |
|
Page views and route change duration |
|
The p75 time in nanoseconds of the document load and, or, the route change time for the given time range. Route changes in Splunk RUM are events with zero second durations. For more, see Document load. |
|
JavaScript errors |
|
The total number of spans with JavaScript errors in the given time range. |
|
Largest contentful paint (LCP) Time |
|
The p75 time of the LCP in nanoseconds for the given time range. |
|
INP (Interaction to next paint) |
|
The p75 time of the INP in nanoseconds for the given time range. |
|
Cumulative layout shift (CLS) |
|
The p75 time of the CLS in nanoseconds for the given time range. |
|
Long task count |
|
The total number of long tasks in the given time range. |
|
Long task duration |
|
The p75 time for long task duration in nanoseconds. |
|
Network requests (HTTPS, XHR, AJAX) |
|
The total number of network requests such as https, XHR, AJAX, and retrieve events in a given time range. |
|
Back-end and Resource request Duration |
|
The p75 time in nanoseconds for AJAX and back-end latency in the given time range. |
|
Time to first byte (TTFB) |
|
The p75 time in nanoseconds for TTFB for the given time range. |
Request timing annotations π
All spans produced by the Browser RUM agent are annotated with performance timings, as specified by the W3C specification for the PerformanceNavigationTiming
interface:
Name |
Timestamp |
---|---|
|
Immediately before the browser starts to fetch the resource. |
|
Immediately before the browser starts the domain name lookup for the resource. |
|
Immediately after the browser finishes the domain name lookup for the resource. |
|
Immediately before the browser starts to establish the connection to the server to retrieve the resource. |
|
Immediately before the browser starts the handshake process to secure the current connection. |
|
Immediately after the browser finishes establishing the connection to the server to retrieve the resource. |
|
Immediately before the browser starts requesting the resource from the server. |
|
Immediately after the browser receives the first byte of the response from the server. |
|
Immediately after the browser receives the last byte of the resource or immediately before the transport connection is closed. |
Data forwarding limits π
The Browser RUM agent has the following built-in limits:
The forwarding frequency for data batches is 5 seconds.
The agent can send 100 spans in 30 seconds per component. Spans produced beyond the limit are dropped.
Tag values can be up to 4,096 characters long. The agent truncates longer values.
The batch size, as determined by the number of spans, is 20 spans.
Collection and retention of geographical data π
The browser agent sends the IP addresses of all beacon connections to Splunk Observability Cloud, which uses them to map the geographical location of the user, such as country, city, and so on.
Note
Splunk Observability Cloud calculates only geographical metadata from the IPs, and drops IP addresses within 6 hours.
Instrumentation-specific data π
See Instrumentation-specific data for Browser RUM for more information on Browser RUM instrumentations and the data they collect.