Filter by tags in Splunk RUM 🔗

Filtering your data by tags helps you refine the scope of your search results and glean meaningful insights. In Splunk RUM, you can filter both indexed and unindexed tags by two operators = and !=.

Understand the results of your search 🔗

These two examples explain how search results differ depending on the combination of filters you select.

Apply multiple filters under the same operator 🔗

You can apply multiple filters under the same operator. For example, this image shows how to select multiple browser types. The results from this search include metrics, events, or sessions originating from Chrome, Electron, Firefox, or Safari.

This shows how to apply multiple filters under the same = sign operator.

Apply separate filters 🔗

Suppose you want to monitor the checkout latency of your site on Chrome. If you apply these filters, then the results of the search include metrics, events, or sessions from the custom event Checkout that occurred on a Chrome browser.

This shows how to select two different filters, in this case Browser=Chrome and Custom Event Name = Checkout.

Search for unindexed tags 🔗

To search for unindexed tags, type the tag and value into the filter bar. This following animation shows an example from the fictitious Buttercup Industries on how to filter by an unindexed tag called ButtercupSession.

Search for indexed tags 🔗

Splunk RUM provides the ability to filter on the following tags out of the box:

Splunk RUM for Browser	Splunk RUM for Mobile
url name operation HTTP Method and status code custom event name browser and version OS name and version city, region, country	network connection HTTP method and status code screen name operation custom event name url name app version device name platform OS name and version city, region, country

Why are some tag values undefined? 🔗

You might see the following message in the Splunk RUM Tag Spotlight page: “Tag value undefined.” This means that there were no tag values associated with the span. There are many reasons why a tag value might be undefined. Here are two examples:

If a URL doesn’t load because of a poor network connection, the HTTPS status codes might be unavailable. This situation results in the message “Tag value undefined.”
For some errors, the error type, message, or stack trace could be unavailable. In this scenario, you might see the following message: “JS Errors without type, message or stack trace.” This means that the spans were missing information (required to compute the ErrorId) when they were ingested into Splunk RUM.

Examples on how to filter by tags 🔗

The following examples outline how you can filter tags in Splunk RUM.

Search by status code 🔗

Suppose you want to filter by status code, excluding 200s. You can apply a filter like in the image below. Using the wildcard *, you can search for all status codes starting with 2 and then using the != operator you can filter out the success status code.

This shows how to search for multiple tag values using the * wildcard.

Similarly, if you want to search for all 400 error responses, but not 404 you can apply filters like these:

Search for a specific browser version 🔗

This example shows how to search for all data from a browser version 99.0 excluding one release.

This shows how to search for multiple tags at the same time.

Include all results or exclude all results 🔗

This search returns results for all browser versions.

This shows how to search for all results for a filter.

If you want to search for results with no browser version you can apply the filter BrowserVersion != *.

Related Topics