Docs » Filter by tags in Splunk RUM

Filter by tags in Splunk RUM 🔗

Filtering your data by tags helps you refine the scope of your search results and glean meaningful insights. In Splunk RUM, you can filter both indexed and unindexed tags by two operators = and !=.

Search for unindexed tags 🔗

To search for unindexed tags, type the tag and value into the filter bar. This following animation shows an example from the fictitious Buttercup Industries on how to filter by an unindexed tag called ButtercupSession.

This shows how to search for unindexed tags by typing in the value directly into the filter box.

Search for indexed tags 🔗

Splunk RUM provides the ability to filter on the following tags out of the box:

Splunk RUM for Browser

Splunk RUM for Mobile

  • url name

  • operation

  • HTTP Method and status code

  • custom event name

  • browser and version

  • OS name and version

  • city, region, country

  • network connection

  • HTTP method and status code

  • screen name

  • operation

  • custom event name

  • url name

  • app version

  • device name

  • platform

  • OS name and version

  • city, region, country

Why are some tag values undefined? 🔗

You might see the following message in the Splunk RUM Tag Spotlight page: “Tag value undefined.” This means that there were no tag values associated with the span. There are many reasons why a tag value might be undefined. Here are two examples:

  • If a URL doesn’t load because of a poor network connection, the HTTPS status codes might be unavailable. This situation results in the message “Tag value undefined.”

  • For some errors, the error type, message, or stack trace could be unavailable. In this scenario, you might see the following message: “JS Errors without type, message or stack trace.” This means that the spans were missing information (required to compute the ErrorId) when they were ingested into Splunk RUM.

Examples on how to filter by tags 🔗

The following examples outline how you can filter tags in Splunk RUM.

Search by status code 🔗

Suppose you want to filter by status code, excluding 200s. You can apply a filter like in the image below. Using the wildcard *, you can search for all status codes starting with 2 and then using the != operator you can filter out the success status code.

This shows how to search for multiple tag values using the * wildcard.

Similarly, if you want to search for all 400 error responses, but not 404 you can apply filters like these:

This shows how to search for multiple tag values using the * wildcard.

Search for a specific browser version 🔗

This example shows how to search for all data from a browser version 99.0 excluding one release.

This shows how to search for multiple tags at the same time.

Include all results or exclude all results 🔗

This search returns results for all browser versions.

This shows how to search for all results for a filter.

If you want to search for results with no browser version you can apply the filter BrowserVersion != *.