Filter by tags in Splunk RUM 🔗
Filtering your data by tags helps you refine the scope of your search results and glean meaningful insights. In Splunk RUM, you can filter both indexed and unindexed tags by two operators = and !=.
Understand the results of your search 🔗
These two examples explain how search results differ depending on the combination of filters you select.
Apply multiple filters under the same operator 🔗
You can apply multiple filters under the same operator. For example, this image shows how to select multiple browser types. The results from this search include metrics, events, or sessions originating from Chrome, Electron, Firefox, or Safari.
Apply separate filters 🔗
Suppose you want to monitor the checkout latency of your site on Chrome. If you apply these filters, then the results of the search include metrics, events, or sessions from the custom event Checkout that occurred on a Chrome browser.
Search for unindexed tags 🔗
To search for unindexed tags, type the tag and value into the filter bar. This following animation shows an example from the fictitious Buttercup Industries on how to filter by an unindexed tag called ButtercupSession.
Search for indexed tags 🔗
Splunk RUM provides the ability to filter on the following tags out of the box:
Splunk RUM for Browser
Splunk RUM for Mobile
Why are some tag values undefined? 🔗
You might see the following message in the Splunk RUM Tag Spotlight page: “Tag value undefined.” This means that there were no tag values associated with the span. There are many reasons why a tag value might be undefined. Here are two examples:
If a URL doesn’t load because of a poor network connection, the HTTPS status codes might be unavailable. This situation results in the message “Tag value undefined.”
For some errors, the error type, message, or stack trace could be unavailable. In this scenario, you might see the following message: “JS Errors without type, message or stack trace.” This means that the spans were missing information (required to compute the ErrorId) when they were ingested into Splunk RUM.
Examples on how to filter by tags 🔗
The following examples outline how you can filter tags in Splunk RUM.
Search by status code 🔗
Suppose you want to filter by status code, excluding 200s. You can apply a filter like in the image below. Using the wildcard *, you can search for all status codes starting with 2 and then using the != operator you can filter out the success status code.
Similarly, if you want to search for all 400 error responses, but not 404 you can apply filters like these:
Search for a specific browser version 🔗
This example shows how to search for all data from a browser version 99.0 excluding one release.
Include all results or exclude all results 🔗
This search returns results for all browser versions.
If you want to search for results with no browser version you can apply the filter
BrowserVersion != *.