Docs » Instrument mobile and web applications for Splunk RUM » Instrument browser-based web applications for Splunk RUM » RUM Browser data model

RUM Browser data model πŸ”—

The Browser RUM agent collects general RUM telemetry data about your front-end web application, as well as data from several instrumentations.

Common data types πŸ”—

The Splunk RUM data model represents the following logical entities, following OpenTelemetry conventions:

Trace

A set of events triggered as a result of a single logical operation, distributed across various components of an application. Traces contain events that cross process, network, and security boundaries. A RUM trace can, for example, initiate when someone taps on a button to start an action on a website. If you use RUM and APM together, traces represent calls made between the downstream services that handle the requests initiated by the user action.

Span

An operation within a transaction. A single span includes the logical name, the start and end timestamp of the operation, and the events and attributes linked to the captured data. A span might have a reference to its parent span and zero or more causally-related spans. Spans have universal attributes and custom attributes.

Session

A collection of traces that correspond to the actions a single user takes when interacting with an application over a period of time. By default, a session lasts until 15 minutes passed from the last event captured in the session. The maximum session duration is 4 hours.

Interaction

Reflects the action the user conducts within the user interface. Common interaction types include mouse clicks, taps on a touch screen, and keyboard events.

User

By default, Splunk RUM doesn’t collect identity data. Mapping a trace to a specific user requires manual instrumentation. Users can be represented by their username, email addresses, or using a synthetic identifier. Synthetic representation is useful in situations where PII regulations do not allow users to be identified. For more information on how to add identity data, see Add user metadata using global attributes.

Basic properties πŸ”—

The following properties are common to all web applications instrumented for Splunk RUM:

Name

Type

Description

id

String

Unique 64-bit identifier generated for the span within the trace.

parentId

String

Parent span ID. Absent if the span is the root span in a trace.

name

String

Logical operation the span represents. For example, /pay or /customers/{1}/details.

duration

Number

Duration in microseconds.

traceId

String

Unique 128-bit identifier, set on all spans belonging to the trace.

timestamp

Number

Epoch microseconds of the start of the span. Can be absent if incomplete.

tags

Object

Additional context, allowing to search and analyze spans based on specific tags.

annotations

Array

Associates events that explain latency with the time they happened.

Metrics πŸ”—

The following tables list all of the metrics available in Splunk RUM for Browser. All errors in Splunk RUM have the dimension sf_error=true. Metrics with the prefix rum.node. are page level metrics, whereas metrics with the prefix rum. are aggregations of multiple pages. Page level metrics also have a dimension sf_node_name, which you can use to filter on specific pages.

App level metric name

UI name

Page level metric

Description

rum.workflow.count

Custom Event Count

rum.node.workflow.count

The total number of spans with the selected custom event in the given time range.

rum.workflow.time.ns.p75

Custom Event Duration

rum.node.workflow.time.ns.p75

The p75 time in nanoseconds of spans with the selected custom event in the given time range.

rum.page_view.count

Page Views and Route Changes

rum.node.page_view.count

The total number of page views and route changes sorted by page for the given time range.

rum.page_view.time.ns.p75

Page Views and Route Change Duration

rum.node.rum.page_view.time.ns.p75

The p75 time in nanoseconds of the page load and route change time for the given time range. Route changes in Splunk RUM are events with zero second durations.

rum.client_error.count

JavaScript Errors

rum.node.client_error.count

The total number of spans with Javascript errors in the given time range.

rum.webvitals_lcp.time.ns.p75

LCP (Largest Contentful Paint) Time

rum.node.webvitals_lcp.time.ns.p75

The p75 time of the LCP (Largest Contentful Paint) in nanoseconds for the given time range.

rum.webvitals_fid.time.ns.p75

FID (First Input Delay) Time

rum.node.rum.webvitals_fid.time.ns.p75

The p75 time of the FID (First Input Delay) in nanoseconds for the given time range.

rum.webvitals_cls.score.p75

CLS (Cumulative Layout Shift)

rum.node.rum.webvitals_cls.score.p75

The p75 time of the CLS (Cumulative Layout Shift) in nanoseconds for the given time range.

rum.long_task.count

Long Task Count

rum.node.long_task.count

The total number of long tasks in the given time range.

rum.long_task.time.ns.p75

Long Task Duration

rum.node.long_task.time.ns.p75

The p75 time for long task duration in nanoseconds.

rum.resource_request.count

Network Requests (HTTPS, XHR, AJAX)

rum.node.resource_request.count

The total number of network requests such as https, XHR, AJAX, and retrieve events in a given time range.

rum.resource_request.time.ns.p75

Back-end and Resource request Duration

rum.node.resource_request.time.ns.p75

The p75 time in nanoseconds for AJAX and back-end latency in the given time range.

rum.resource_request.ttfb.time.ns.p75

TTFB (Time to First Byte)

rum.node.resource_request.time.ns.p75

The p75 time in nanoseconds for TTFB for the given time range.

Default tags πŸ”—

By default, the Browser RUM agent adds the following tags to all spans:

Name

Type

Description

app

String

Application name, as set in the configuration.

component

String

Instrumentation name that produced the span. For example, document-load.

location.href

String

Location URL at the moment of creating the span.

splunk.rumSessionId

String

Session ID, collected from the _splunk_rum_sid cookie. See Cookies used by the Browser RUM agent.

splunk.rumVersion

String

Version of the Splunk RUM SDK instrumenting the application.

splunk.scriptInstance

String

The 64-bit ID of the splunk-otel-web.js instance. The ID is renewed every time the page is reloaded. This is useful, for example, when distinguishing between different open tabs within the same browser window which share the same session.

otel.status_code

String

If set, the value can be either OK or ERROR.

telemetry.sdk.language

String

Always webjs.

telemetry.sdk.name

String

Always @splunk/otel-web.

Request timing annotations πŸ”—

All spans produced by the Browser RUM agent are annotated with performance timings, as specified by the W3C specification for the PerformanceNavigationTiming interface:

Name

Timestamp

fetchStart

Immediately before the browser starts to fetch the resource.

domainLookupStart

Immediately before the browser starts the domain name lookup for the resource.

domainLookupEnd

Immediately after the browser finishes the domain name lookup for the resource.

connectStart

Immediately before the browser starts to establish the connection to the server to retrieve the resource.

secureConnectionStart

Immediately before the browser starts the handshake process to secure the current connection.

connectEnd

Immediately after the browser finishes establishing the connection to the server to retrieve the resource.

requestStart

Immediately before the browser starts requesting the resource from the server.

responseStart

Immediately after the browser receives the first byte of the response from the server.

responseEnd

Immediately after the browser receives the last byte of the resource or immediately before the transport connection is closed.

Data forwarding limits πŸ”—

The Browser RUM agent has the following built-in limits:

  • The forwarding frequency for data batches is 5 seconds.

  • The agent can send 100 spans in 30 seconds per component. Spans produced beyond the limit are dropped.

  • Tag values can be up to 4,096 characters long. The agent truncates longer values.

  • The batch size, as determined by the number of spans, is 20 spans.

Collection and retention of geographical data πŸ”—

The browser agent sends the IP addresses of all beacon connections to Splunk Observability Cloud, which uses them to map the geographical location of the user, such as country, city, and so on.

Note

Observability Cloud calculates only geographical metadata from the IPs, and drops IP addresses within 6 hours.

Instrumentation-specific data πŸ”—

See Instrumentation-specific data for Browser RUM for more information on Browser RUM instrumentations and the data they collect.