System limits for Splunk RUM

Splunk RUM has system limits that help ensure good performance, stability, and reliability. These limits also protect the Splunk RUM multi-tenant environment. Exceeding these limits might degrade your Splunk RUM experience.

Subscriptions

There are two types of subscriptions: enterprise and standard. For more information on each type of subscription, see Splunk RUM Pricing.

Session lifecycle limits

Limit name

Default limit value

Notes

Max session duration

4 hours

If you exceed the limit, Splunk RUM generates a new session ID but doesn’t drop the span.

Max inactive time in session

15 minutes

If you exceed the limit, Splunk RUM generates a new session ID but doesn’t drop the span.

Monthly session limits

For organizations with DXA, RUM sessions count toward both monthly allowances. The DXA allowance does not independently block RUM ingestion. These limits are organization-wide across RUM access tokens. Per-token limits remain separate. The session that reaches a limit is accepted; the limit then applies to the next new session.
Default limit Notes
RUM sessions Existing sessions continue, but new sessions receive HTTP 429 after the organization's monthly limit is reached.
Session Replay Existing replay sessions continue. New replay sessions require available capacity under both the RUM and Session Replay monthly organization limits and can receive HTTP 429 when either limit is reached.
Digital Experience Analytics (DXA) add-on For organizations with DXA, RUM sessions count toward both monthly allowances. The DXA allowance does not independently block RUM ingestion.
If you encounter a HTTP 429 response, the following are explanations of the errors:

  • monthly-quota-reached: A monthly session limit was reached. Retry-After contains the next monthly reset date.

  • throughput-exceeded: A per-minute bytes or spans limit was reached. Retry-After is currently 60 seconds.

Data ingestion limits

Splunk RUM notifies you if you’ve exceeded the limit with a status code error. Data ingestion limits are determined by your subscription.

Limit name

Default limit value

Bytes per minute (BPM)

Determined by your subscription

Spans Per Minute (SPM)

Determined by your subscription

Span size

128kB

MetricSet limits

Default limit

Notes

Troubleshooting MetricSets (TMS)

TMS limits are determined by your subscription. If you exceed the limit session events or spans aren’t dropped.

Monitoring MetricSets

Monitoring MetricSets are determined by your subscription. For more information on system limits for Monitoring MetricSets, see System limits for Splunk Infrastructure Monitoring.

Data retention limits

Data retention in RUM is tiered based on your subscription:

SKU RUM Sessions RUM Spans DXA Spans
RUM 8-day 8 days 8 days 8 days
RUM 30-day 30 days 30 days 30 days
RUM 8-day + Digital Experience Analytics (DXA) add-on 13 months 8 days 13 months
RUM 30-day + Digital Experience Analytics (DXA) add-on 13 months 30 days 13 months

The effect of exceeding a limit depends on the limit. Monthly session limits affect new sessions while existing sessions continue. Per-minute ingestion and span-size limits can cause data to be dropped.

Additional limit details for Splunk RUM

To help you optimize your product experience, this section describes the following:

  • The name and value of each system limit.

  • If available, the organization metrics associated with the limit.

  • The impact you observe when you exceed the limit.

Bytes per minute (BPM)

Default limit

Notes

Determined by Session Volume entitlement as per contract

The number of session events or spans dropped after this limit is reached. Monitor how many spans were dropped when you exceeded the throttle for BPM with the following metrics:

  • sf.org.rum.numSpansDroppedThrottle

  • sf.org.rum.grossSpanBytesReceived

  • sf.org.rum.grossContentBytesReceived

  • sf.org.rum.numSpanBytesReceived

numSpanBytes is the size of the spans that Splunk RUM accepted.

Spans Per Minute (SPM)

Default limit

Notes

Determined by Session Volume entitlement as per contract

The number of session events or spans dropped after this limit is reached. Monitor SPM with the following metrics:

  • sf.org.rum.numSpansDroppedThrottle

  • sf.org.rum.numSpansReceived

  • sf.org.rum.grossSpansReceived

Span size

Default limit

Notes

128kB

The volume of an individual RUM event or span in kB. If you exceed the limit, Splunk RUM drops the span and doesn’t analyze the contents. Measure the number of drops due to span size with this metric sf.org.rum.numSpansDroppedInvalid. You can also add the dimension spanTooLarge.