Docs » Welcome

---

Welcome

. Welcome to Splunk Observability Cloud Learn about the basic elements of Splunk Observability Cloud and all it can do for you.

Overview Splunk Observability Cloud overview Splunk Observability Cloud overview

Scenarios A collection of scenarios for using Splunk Observability Cloud to address your goals Splunk Observability Cloud scenarios

Tutorials A collection of task-based tutorials to achieve a goal in Splunk Observability Cloud Splunk Observability Cloud tutorials

Get started guide for admins Get started guide for Splunk Observability Cloud admins Get started guide for Splunk Observability Cloud admins

Service description Benefits and service terms of Splunk Observability Cloud Splunk Observability Cloud service description

Architecture Architecture of Splunk Observability Cloud Splunk Observability Cloud architecture

. Get your data in The first step toward observability is getting relevant data into Splunk Observability Cloud. View all supported integrations.

Compatibility and requirements Systems and languages you can use with Splunk Observability Cloud Compatibility and requirements for Splunk Observability Cloud

OpenTelemetry Install the Splunk Distribution of the OpenTelemetry Collector Get started with the Splunk Distribution of the OpenTelemetry Collector

Cloud providers Integrate to collect service metrics and metadata Connect to your cloud service provider

Back-end apps and services Instrument to collect traces and logs Instrument back-end applications to send spans to Splunk APM

Front-end app user experiences Instrument to collect user sessions Instrument mobile and web applications for Splunk RUM

Serverless functions Instrument to collect traces and logs Instrument serverless functions for Splunk Observability Cloud

. Explore and monitor your environment After you have data coming into Splunk Observability Cloud, you can do some exploring.

Infrastructure Monitoring Monitor server and cluster metrics What can I do with Splunk Infrastructure Monitoring?

Application Performance Monitoring Monitor back-end app and service traces Introduction to Splunk APM

Real User Monitoring Monitor data about front-end app user experiences What can I do with Splunk RUM?

Log Observer Connect Query logs to identify root causes Introduction to Splunk Log Observer Connect

Synthetic Monitoring Proactively monitor the performance of web resources Introduction to Splunk Synthetic Monitoring

All products Learn more about all Splunk Observability Cloud products Splunk Observability Cloud overview

. Set up alerts and customize your account Prepare for issues that might arise by setting up alerts, custom dashboards, and other advanced features.

Detectors and alerts Receive alerts about conditions you care about Create detectors to trigger alerts

Dashboards and charts Get actionable insights about the systems you monitor Dashboards in Splunk Observability Cloud

Span tags Use span tags to add useful metadata to traces Add context to spans with span tags in Splunk APM

Related Content Enable users to seamlessly move across product views Related Content in Splunk Observability Cloud

Global Data Links Provide convenient access to relevant resources Link metadata to related resources using global data links

. Administer your account As a Splunk Observability Cloud administrator, use these tools to give your users a secure and relevant user experience.

Get started Learn how to set up and administer your organization Set up your Splunk Observability Cloud organization

Access tokens Authenticate and track API use Create and manage organization access tokens using Splunk Observability Cloud

Users Invite users and set access levels Create and manage users in Splunk Observability Cloud

Teams Create teams to help coordinate teamwork Create and manage teams in Splunk Observability Cloud

Single sign-on Set up an integration to an SSO provider Configure SSO integrations for Splunk Observability Cloud

Subscription usage Monitor subscription usage for Infrastructure Monitoring Monitor and manage subscription usage and billing

. Popular integrations Access documentation for some of the most popular integrations used to get data into Splunk Observability Cloud.

Linux Collect metrics and logs Collect Linux data

Kubernetes Collect metrics and logs Collect Kubernetes data

Windows Collect metrics and logs Collect Windows data

Amazon Web Services Collect metrics and logs Connect AWS to Splunk Observability Cloud

Azure Collect metrics Connect your Azure account to Splunk Observability Cloud

Browser Collect user sessions Instrument browser-based web applications for Splunk RUM

.NET Collect traces Instrument .NET applications for Splunk Observability Cloud (OpenTelemetry)

Java Collect traces Instrument Java applications for Splunk Observability Cloud

Ruby Collect traces Instrument Ruby applications for Splunk Observability Cloud (OpenTelemetry)

Node.js Collect traces Instrument Node.js applications for Splunk Observability Cloud

PHP Collect traces Instrument PHP applications for Splunk Observability Cloud

C++ Collect traces Instrument C++ applications for Splunk Observability Cloud

All supported integrations View a list of all supported integrations Supported integrations in Splunk Observability Cloud

. Release notes To keep up to date with changes in the products, see the Splunk Observability Cloud release notes.

Get started

• Get started with Splunk Observability Cloud

• Overview

• Architecture

• Get started guide for admins TOGGLE

• AI Assistant in Observability Cloud

• Prompt guide and library for AI Assistant in Observability Cloud

• Service description

• Free and paid courses

• Free trial and guided onboarding

• About Mobile TOGGLE

• Support
  • Submit a Splunk Support Portal case

Scenarios and tutorials

• Scenarios

• Tutorials

Splunk platform users

• Splunk Observability Cloud and the Splunk platform

• Unified Identity
  • What is Unified Identity?
  • Who can access Single Sign On (SSO) and the benefits of Unified Identity?
  • What are the benefits of Unified Identity?
  • How to set up Unified Identity
    • Prerequisites
    • Set up Unified Identity for new Splunk Observability Cloud customers
    • Set up Unified Identity for existing Splunk Observability Cloud customers
  • User provisioning
    • Existing Splunk Cloud Platform users
    • Existing Splunk Observability Cloud users
    • New users
    • Centralized user and role management
    • After initial user provisioning
  • What to expect at first login
    • No access error
  • Working in Splunk Observability Cloud after the integration
    • Point-and-click log analysis
    • Related Content
    • Unified user session
    • Splunk Cloud Platform maintenance windows
    • Changing identity providers

• Centralized user and role management
  • Who can access centralized user and role management?
  • Prerequisites
  • How to set up centralized user and role management
    • New Splunk Observability Cloud customers
    • Existing Splunk Observability Cloud customers
  • How centralized user and role management works
  • Troubleshooting
    • No access issue
    • Cause
    • Solution
    • Multiple errors issue
    • Cause
    • Solution

• Scenarios

Administer Splunk Observability Cloud

• Set up your Splunk Observability Cloud organization

• Authentication and Security TOGGLE

• User and team management TOGGLE

• View organization metrics
  • Access organization metrics
  • Interpret and work with org metrics
    • Data limiting, data throttling, and data filtering
    • Compare gross and num metric values
    • Metrics that track system limits
    • Metrics that track data throttling
    • Metrics for values by token
    • Metrics with values for each metric type
    • A metric that counts stopped detectors
    • Cloud authentication error metrics
    • Child org metrics
  • List of organization metrics
  • Troubleshooting

• Monitor subscription usage and billing TOGGLE

• Org reference info TOGGLE

Get your data in

• Get data into Splunk Observability Cloud

• Compatibility and requirements
  • Infrastructure monitoring (IM)
    • Linux
    • Windows
    • Available host and application monitors
    • Processor architecture
  • Application monitoring (APM)
    • Java
    • Node
    • .NET
    • Go
    • Python
    • Ruby
    • PHP
    • AWS Lambda functions
  • Real user monitoring (RUM)
    • Android
    • iOS
    • Web applications
    • React Native
  • Support

• Available integrations TOGGLE

• Connect to your cloud service provider TOGGLE

• Private connectivity TOGGLE

• Splunk Distribution of the OpenTelemetry Collector TOGGLE

• Collect infrastructure metrics and logs TOGGLE

• Instrument back-end services TOGGLE

• Instrument serverless functions TOGGLE

• Instrument front-end applications TOGGLE

• Other data ingestion methods
  • Send telemetry using the OpenTelemetry Collector Contrib project
    • Feature comparison
    • Prerequisites
    • Sample configuration for Splunk Observability Cloud
    • Migrate to the Splunk Distribution of OpenTelemetry Collector
    • Troubleshooting
  • Send data using REST APIs
    • Start sending data using the API
      • Send custom metrics using the API
    • Return codes
  • Send custom metrics to Splunk Observability Cloud
    • Send custom infrastructure or service metrics
      • Add a receiver for custom metrics
      • Add the required dependencies
      • Send custom metrics to the Collector
    • Send custom application metrics
  • Send traces to Splunk Observability Cloud using the gRPC endpoint
    • Send traces using the gRPC endpoint
      • Configure the Splunk OpenTelemetry Collector
      • Send data in OTLP format over HTTP
  • Set the host.name attribute override using the OpenTelemetry Helm chart

Understand and analyze your data

• Data types in Splunk Observability Cloud
  • Quick overview of Splunk Observability Cloud data types
  • Next steps: Tools and analytics

• Use internal search
  • Prerequisites
  • Supported search prefixes
  • How to use Observability search

• Metrics, metadata and events TOGGLE

• Data tools TOGGLE

• SignalFlow and analytics TOGGLE

Dashboards and charts

• Dashboards TOGGLE

• Charts TOGGLE

• Navigate with data links
  • Choose a data link type
    • Configure local data links
    • Select a property value to follow a link
  • More specific data links override less specific data links
  • Local data links override equally specific global data links
  • Default links override non-default links
    • Use and view data links
  • About defining data links

• Select the time range
  • Specify a relative time range
    • Select a time range from the menu
    • Enter a relative time range
  • Specify an absolute time range
  • Select a custom time range
  • Pan through time ranges

• Read and write permissions
  • Read permissions for dashboard groups and dashboards
    • Rules for setting read permissions
  • Write permissions
    • Rules for setting write permissions
  • Read and write permissions management

Alerts, detectors, and SLOs

• Alerts and detectors TOGGLE

• Service level objectives TOGGLE

Application Performance Monitoring

• Introduction to Splunk APM

• Key concepts in Splunk APM

• Scenarios for troubleshooting errors and monitoring application performance using Splunk APM TOGGLE

• Set up Splunk APM TOGGLE

• Manage services, spans, and traces in Splunk APM TOGGLE

• Analyze services with span tags and MetricSets TOGGLE

• Correlate traces to track Business Workflows TOGGLE

• Visualize and alert on your application in Splunk APM TOGGLE

• AlwaysOn Profiling TOGGLE

• Monitor Database Query Performance TOGGLE
  • Monitor system health with Database Infrastructure Performance

• Use data links to connect APM properties to relevant resources TOGGLE

• Filter data in Splunk APM

Infrastructure

• Introduction
  • Splunk Infrastructure Monitoring hierarchy
  • Get started with Splunk Infrastructure Monitoring
  • What can I do with Splunk Infrastructure Monitoring?

• Key concepts
  • Data link
  • Navigator
  • Resolution
  • SignalFlow
  • Virtual metrics

• Set up Infrastructure Monitoring
  • Step 1. Connect cloud services
  • Step 2. Collect infrastructure data with the Splunk Distribution of the OpenTelemetry Collector
  • Step 3. Monitor and troubleshoot your infrastructure

• Monitor services and hosts
  • Displayed data: Traffic considerations
    • Navigator considerations

• Use navigators
  • View all navigators
  • Monitor all instances in a navigator
  • Drill down
  • Display related resources or views
  • Use the Dashboard section
  • Customize navigator display
    • Use Navigator pinned filters
    • Add filter
    • Customize time range
    • Color by
    • Group by
    • Find outliers
    • Use metric classes
  • View global data links
  • View metadata
  • View dependencies
    • Best practice
  • View alerts using navigators
  • View navigators using alerts
  • Remove an inactive navigator
  • List available navigators
  • Customize navigators

• Filter data
  • Create a filter
  • Apply a filter
  • Remove a filter

• Metrics pipeline management TOGGLE

• Network Explorer TOGGLE

• Virtual metrics
  • About virtual metrics
  • List of virtual metrics
  • Limitations of virtual metrics

• Resolution and data retention
  • Native resolution
  • Rollups, resolution, and data retention policies
    • Rollups
    • Resolution
    • Retention

• Resolution and data retention (DPM)
  • Native resolution
  • Chart data resolution
    • Plots with different resolutions
    • Minimum chart resolution
    • Chart resolution and data retention

Log Observer Connect

• Splunk Log Observer Connect

Real User Monitoring

• Introduction to Splunk RUM
  • What can I do with Splunk RUM?
  • (Optional) Link RUM spans to APM spans
  • Get data in

• Key concepts in Splunk RUM
  • Session
  • Session ID
  • Spans
    • Spans in Splunk RUM for Browser
    • Spans in Splunk RUM for Mobile
  • Trace
    • Browser trace
    • Back-end trace
  • User sessions
  • Session details
  • Span ID
  • Tag
  • RUM metrics for mobile applications
    • App start
    • App crashes and errors
    • Presentation transition
  • RUM metrics for browser applications
    • Web vitals
    • Errors
  • Error ID
  • Custom events
  • Built-in dashboards
  • Global attributes

• Splunk RUM scenario library TOGGLE

• Set up Splunk RUM
  • Generate your RUM access token in Splunk Observability Cloud
  • Get data in
  • Check that your data is coming in
  • Learn about the types of data RUM collects

• Use controls for sensitive data in Splunk RUM
  • What is sensitive data ?
  • Splunk RUM for Browser instrumentation
    • Examples
  • Splunk RUM for Mobile Android instrumentation
    • Examples
  • Splunk RUM for mobile iOS instrumentation
    • Examples
  • See also

• Data collected by Splunk RUM
  • Platform-specific RUM data

• Create custom events
  • How custom events can add value to your organization
    • Use case
  • Create a custom event
  • Next steps with custom events
  • Advanced instrumentation

• Error monitoring and crash aggregation in Tag spotlight
  • Mobile crash aggregation
    • Explore top crashes across in Tag Spotlight
  • JavaScript error aggregation
    • Find the top JavaScript errors across your applications in Tag Spotlight
    • JS Errors without stacktrace, type, or message
  • Learn more

• Identify errors in browser spans
  • Errors in Splunk RUM
  • JavaScript errors
    • JavaScript console errors
    • Uncaught JavaScript errors
  • Back-end errors and long resource response times
    • Resource errors
    • Resource response time
    • Example span
  • Summary

• Filter your data by tags in Splunk RUM
  • Understand the results of your search
    • Apply multiple filters under the same operator
    • Apply separate filters
  • Search for global attributes
    • How to set global attributes
    • Global attributes examples
    • Span attributes example
  • Search for unindexed tags
  • Undefined tag values
  • Search for indexed tags
  • Why are some tag values undefined?
  • Examples on how to filter by tags
    • Search by status code
    • Search for a specific browser version
    • Include all results or exclude all results

• Write custom rules for URL grouping in Splunk RUM
  • What are custom rules in Splunk RUM?
  • Write a custom rule
  • How to identify components of a URL
    • Example
  • How to identify tokens
    • Domain
    • Path
    • Support for # in URLs
  • Pattern syntax
    • What is a rule?
    • What is a pattern?
    • <?> Wildcard for single token
    • <??> Wildcard for one or more trailing tokens
    • Combination pattern
  • Invalid syntax
  • Default rules
    • Example
    • Example
  • Use cases
    • Use a <?> wildcard to group URLs by product ID
    • Use a <?> wildcard to group by subdomain
    • Use a <??> wildcard to group by string
  • Manage URL grouping rules
    • Create a new rule
    • Edit an existing rule
    • Deactivate or reactivate a rule
    • Delete

• Alert on Splunk RUM data
  • How alerts work in Splunk RUM
    • Integrations
    • Data retention
  • Types of metrics you can alert on
  • Alert configuration examples
    • Alert trigger conditions
    • Page level metrics
    • App level metrics
    • URL level metrics
  • Create a detector
  • Create dashboards for your RUM alerts
  • View detectors and alerts

• Splunk RUM dashboards TOGGLE

• Splunk RUM metrics reference
  • Aggregates versus page level metrics
  • Custom event metrics
  • Learn more

• Session replay in Splunk RUM
  • Use cases
  • Prerequisite
  • Set up session replay
    • CDN
    • Self-hosted
    • NPM
    • Deactivate session replay
    • Additional instrumentation settings
  • Redact information
    • Image redaction
  • Replay a session
  • Troubleshooting

• Filter and troubleshoot with custom tags
  • Key concepts
    • Span tags
    • MetricSets
    • Default tags
  • Example: track custom processes
  • Add custom tags to Tag Spotlight
  • Troubleshooting
    • Avoid high cardinality in MetricSets

• Experiment with the demo applications for Splunk RUM for Mobile
  • Android demo app
  • iOS demo app

• Third-party software

Synthetics

• Introduction to Splunk Synthetic Monitoring
  • How does Splunk Synthetic Monitoring work?
  • Use cases for Splunk Synthetic Monitoring
  • Create your first test with Splunk Synthetic Monitoring

• Key concepts in Splunk Synthetic Monitoring
  • Learn more

• Synthetics built-in dashboards
  • Go to Synthetics built-in dashboards
  • Troubleshoot an issue from a built-in dashboard
  • Dashboards for alerts and detectors
  • Learn more

• Synthetics scenario library TOGGLE
  • Scenario: Monitor a multi-step workflow using a Browser test
    • Set up a Browser test to monitor a critical workflow
    • Summary
    • Learn more
  • Scenario: Monitor API performance for a critical workflow
    • Monitor API performance for a checkout workflow
    • Learn more about API tests
  • Scenario: Monitor the performance of a user-facing application
    • Set an Uptime test to monitor a mobile app endpoint
    • Learn more
  • Scenario: Compare run results to Web Vitals with Splunk RUM
    • About this scenario
    • Summary

• Set up Splunk Synthetic Monitoring
  • Get your site ready to run synthetic tests
    • Allow Splunk Synthetic Monitoring IP addresses
    • Exclude Splunk Synthetic Monitoring from analytics
  • Choose a test
  • Set up your first test
  • Get audit logs
  • (Optional) Link Synthetic spans to APM spans
    • (Optional) Integrate with Splunk RUM
  • Continue learning

• Browser tests for webpages TOGGLE
  • Set up a browser test
    • Set up a browser test
    • Import a JSON file generated from Google Chrome Recorder
    • Troubleshoot unsupported steps
    • View your browser test
    • Edit your browser test
    • Advanced settings for browser tests
    • Example
  • Add synthetic transactions to your Browser Test
    • What are synthetic transactions?
    • What are steps?
    • Add synthetic transactions to your Browser Test
  • Interpret Browser test results
    • View Browser test history
    • Interpret Browser test run results
  • Browser test metrics
    • Metrics for Browser tests
    • Detect and report on your synthetic metrics

• Uptime tests for port and HTTP TOGGLE
  • Set up an Uptime test
    • Configure an HTTP Uptime test
    • Configure a Port Uptime test
    • View your Uptime test
    • Interpret your Uptime test results
    • Advanced settings for uptime tests
    • Example
  • Interpret Uptime test results
    • View Uptime test history
    • Interpret Uptime test run results
    • Uptime test metrics

• API tests for endpoints TOGGLE
  • Set up an API test
    • Set up an API test
    • Example
  • Interpret API test results
    • View API test history
    • Interpret API test run results
  • API test metrics
    • Dimensions
    • Request level metrics
    • Run-level metrics
  • Synthetics support for JavaScript

• Test status TOGGLE
  • Test performance KPIs
    • Performance KPI chart settings
  • Filter tests
  • View test state
  • Single actions
  • Bulk actions

• Advanced test configurations TOGGLE
  • Authentication
    • Basic authentication through HTML login forms
    • Basic authentication through HTTP headers
    • Basic authentication through API request headers
    • Multifactor authentication through SMS
    • Multifactor authentication through email
    • Multifactor authentication through SSO and Active Directory
    • Multifactor authentication through TOTP
  • Built-in variables
    • Random variables
    • Date-and-time variables
    • Location variables
    • Request variables for API Tests
    • Use a variable in a test
  • Custom variables
    • How to create a custom variable
    • How to use a custom variable
    • See also
  • Detectors and alerts
    • Types of detectors in Synthetics
    • Best practices for sending an alert when a synthetic test fails
    • Set up a detector for Splunk Synthetic Monitoring tests
  • Devices
    • Select a device type for Splunk Synthetic Monitoring tests
  • Downtime
    • Schedule a downtime configuration
    • Modify a downtime configuration
    • Mute alerts during downtime
    • View the downtime configurations that apply to a given test
    • Records
  • Global variables
    • How can you use a global variable?
    • What happens when you conceal a global variable?
    • Create a global variable
    • Edit a global variable
    • Use a global variable in a synthetic test
  • Private locations
    • Use cases for private locations
    • Set up a new private location
    • Private runners
  • Public locations
    • Best practices
    • Locations
    • JSON file of public locations
  • Compare run results to Web Vitals with Splunk RUM
    • Prerequisites
    • Compare Web Vitals for your run results
    • See also
  • Validate your test configuration with try now
    • When to use try now to validate your test configuration
    • Example
    • Limits
  • Test naming conventions

• Troubleshoot tests TOGGLE
  • Troubleshoot test validation

Splunk On-Call

• Introduction to Splunk On-Call TOGGLE

• User management TOGGLE

• Create and manage on-call schedules TOGGLE

• Alerts TOGGLE

• Notifications TOGGLE

• Incidents TOGGLE

• Mobile app TOGGLE

• Reports TOGGLE

• Integrations with Splunk On-Call TOGGLE

Release notes

• Release notes overview TOGGLE

Reference and Legal

• Third-party software credits

• Glossary
  • A
  • C
  • D
  • E
  • F
  • G
  • I
  • M
  • N
  • P
  • R
  • S
  • T
  • Z

• Contribute to our documentation

This page was last updated on Mar 20, 2025.

---

Next

Get started with Splunk Observability Cloud

❯

---

• API docs
• Blog
• Training
• Free Trial