Android RUM data model

Understand what RUM data the Splunk RUM agent collects from Android applications.

The Android agent for Splunk Real User Monitoring (RUM) collects the following types of data about your Android application.

Common data types

The Splunk RUM data model represents the following logical entities, following OpenTelemetry conventions:

Trace

A set of events triggered as a result of a single logical operation, distributed across various components of an application. Traces contain events that cross process, network, and security boundaries. A RUM trace can, for example, initiate when someone taps on a button to start an action on a website. If you use RUM and APM together, traces represent calls made between the downstream services that handle the requests initiated by the user action.

Span

An operation within a transaction. A single span includes the logical name, the start and end timestamp of the operation, and the events and attributes linked to the captured data. A span might have a reference to its parent span and zero or more causally-related spans. Spans have universal attributes and custom attributes.

Session

A collection of traces that correspond to the actions a single user takes when interacting with an application over a period of time. By default, a session lasts until 15 minutes passed from the last event captured in the session. The maximum session duration is 4 hours.

Interaction

Reflects the action the user conducts within the user interface. Common interaction types include mouse clicks, taps on a touch screen, and keyboard events.

User

By default, Splunk RUM doesn’t collect identity data. Mapping a trace to a specific user requires manual instrumentation. Users can be represented by their username, email addresses, or using a synthetic identifier. Synthetic representation is useful in situations where PII regulations do not allow users to be identified.

Basic properties

The following properties are common to all applications instrumented for Splunk RUM:

Name Type Description

id

String

Unique 64-bit identifier generated for the span within the trace.

parentId

String

Parent span ID. Absent if the span is the root span in a trace.

name

String

Logical operation the span represents.

duration

Number

Duration in microseconds.

traceId

String

Unique 128-bit identifier, set on all spans belonging to the trace.

timestamp

Number

Epoch microseconds of the start of the span. Can be absent if incomplete.

tags

Object

Additional context, allowing to search and analyze spans based on specific tags.

annotations

Array

Associates events that explain latency with the time they happened.

Default (global) attributes

By default, the Android RUM agent adds the following attributes to all spans:

Name Description Example

session.id

Session ID.

1b93859337def61246e1edab0a41fba0

otel.scope.name

The name of the instrumentation scope.

SplunkRum, io.opentelemetry.lifecycle

screen.name

The current screen name or unknown.

MainActivity, ShopingCart

network.carrier.icc

Current network attributes.

DE

network.carrier.mcc

310

network.carrier.mnc

001

network.carrier.name

LTE

network.connection.type

wifi

Android metrics

The following tables list all of the metrics available in Splunk RUM for Android. All errors in Splunk RUM have the dimension sf_error=true.

For more information on app startup metrics as defined by Android, see App startup time in the Android Developers documentation.

Metric name UI name Description

rum.workflow.count

Custom workflow Count

The total number of spans with the selected custom event in the given time range.

rum.workflow.time.ns.p75

Custom workflow Duration

The p75 time in nanoseconds of spans with the selected customworkflow in the given time range.

rum.crash.count

Mobile crash

Total number of crashes in the given time range.

rum.app_error.count

App error

Total number of handled exceptions and reported errors in the given time range.

rum.cold_start.time.ns.p75

Cold start time

The p75 time in nanoseconds of cold starts in the given time range.

rum.cold_start.count

Cold start count

Total number of cold starts in the given time range.

rum.warm_start.count

Warm start count

Total number of warm starts in the given time range.

rum.warm_start.time.ns.p75

Warm start time

The p75 time in nanoseconds for a warm start.

rum.hot_start.count

Hot start count

Total number of hot starts in the given time range.

rum.hot_start.time.ns.p75

Hot start time

The p75 time in nanoseconds for a hot start.

rum.resource_request.count

Network or back-end requests/errors

The total number of network requests in a given time range.

rum.resource_request.time.ns.p75

Network or back-end latency

The p75 time in nanoseconds for back-end latency in the given time range.
Additional metrics added to Splunk RUM for Android are listed in the following table. These metrics are available as part of a controlled availability release.
Note: In the Controlled Availability release stage, Splunk products may have limitations on customer access, features, maturity, and regional availability. For additional information on Controlled Availability, please contact your Splunk representative
Metric name UI name Description
rum.slow_renders.count Slow Renders Total number of slow renders that occurred in the given time range.
rum.frozen_frames.count Frozen Frames Total number of frozen frames that occurred in the given time range.
rum.custom_event.count Custom events Total number of custom events that occurred in the given time range.
rum.sessions.count Total Sessions Total number of sessions in the given time range.
rum.sessions.duration Session Duration The p75 time in nanoseconds of total duration of sessions in the given time range.
rum.sessions_crash.count UI displays an inverse of this metric which is Crash Free Sessions Total number of sessions that have a crash in the given time range.
rum.sessions_error.count UI does not display this metric Total number of sessions that have an error in the given time range.
rum.users.count Total Active Users Total number of distinct users in a 24 hour window (UTC).
rum.users_crash_impacted.count UI displays an inverse of this metric which is Crash Free Users Total number of distinct users that experience a crash in a 24 hour window (UTC).
rum.sessions_error.count UI does not display this metric Total number of distinct users that experience an error in a 24 hour window (UTC).

Resource attributes

By default, the Android RUM agent adds the following resource attributes to all spans:

Name Description Examples
app Required. Application name that can be set in the AgentConfiguration or gathered programatically. NewPipe, Wikipedia
app.version Required. Application version that can be set in the AgentConfiguration or is gathered programatically. 1.0.0, 0.3.0-alpha
deployment.environment Required. Name of the deployment environment that must be set in AgentConfiguration. test, staging, production, any-string
device.manufacturer Required. The name of the device manufacturer. Semantic conventions LG, Samsung
device.model.identifier Required. The model identifier for the device. It's recommended this value represents a machine-readable version of the model identifier rather than the market or consumer-friendly name of the device. SM-G920F
device.model.name Required. The marketing name for the device model. It's recommended this value represents a human-readable version of the device model rather than a machine-readable alternative. Samsung Galaxy S6
os.description Required. Human readable (not intended to be parsed) OS version information. Android Version 14 (Build UE1A.230829.036.A4 API level 34)
os.name Required. Human readable operating system name. Android
os.type Required. The operating system type. linux
os.version Required. The version string of the operating system 14
rum.sdk.version Required. Semantic version of the agent. 0.40.0-alpha, 1.0.0

Instrumentation module attributes

The Android RUM agent collects the following data using its instrumentation modules. To activate or deactivate specific instrumentation modules, see Instrumentation settings.

Crash reporting

The Android RUM agent adds the following crash reporting attributes to spans that represent uncaught exceptions:

Name Type Description

thread.id

Integer

ID of the current managed thread, as opposed to the operating system thread ID.

thread.name

String

Name of the thread.

exception.message

String

The message of the exception.

exception.type

String

The type of the exception.

exception.stacktrace

String

The stack trace for the exception.

exception.escaped

String

Always true, denoting the uncaught exception, such as a crash occurring.

component

String

Always crash.

service.application_id

String

Application ID of the app: See the definition of applicationId in the Android Studio developer documentation.

service.version_code

String

Version code of the application: See the definition of versionCode in the Android Studio developer documentation.

splunk.build_id

String

This is an optional attribute. This is added when minification is enabled for pre-production builds where version code is not updated across app builds, in which case this attribute is used to uniquely identify each build.

Network monitoring

Network monitoring produces spans with the name network.change and the following attributes:

Name Type Description
network.carrier.icc String The ISO 3166-1 alpha-2 2-character country code associated with the mobile carrier network. For example, US, DE.
network.carrier.mcc String The mobile carrier country code.
network.carrier.mnc String The mobile carrier network code.
network.carrier.name String The name of the mobile carrier. For example, T-Mobile, AT&T.
network.connection.type String Internet connection type. Possible values are: unavailable, cell, wifi, unknown, vpn.
network.status String Network status. Possible values are lost or available.

Application not responding (ANR)

Application not responding (ANR) event detection generates spans whenever the main application thread is unresponsive for more than 5 seconds.

ANR produces spans with the name ANR and the following attributes:

Name Type Description
component String Always anr.
exception.stacktrace String A stack trace as a string in the natural representation for the language runtime.
service.application_id String Application ID of the app: See the definition of applicationId in the Android Studio developer documentation.
service.version_code String Version code of the application: See the definition of versionCode in the Android Studio developer documentation.
splunk.build_id String This is an optional attribute. This is added when minification is enabled for pre-production builds where version code is not updated across app builds, in which case this attribute is used to uniquely identify each build.

Slow rendering detection

Slow rendering detection generates spans whenever it detects a slow or frozen frame render. Frame rendering is slow if its duration exceeds 16 milliseconds, and frozen if it exceeds 700 milliseconds.

Slow rendering detection generates up to two spans on every interval: a span named slowRenders which counts slow frames, and a span named frozenRenders which counts frozen frames.

Slow rendering detection spans have the following attribute:

Name Type Description

count

Integer

Number of observed slow or frozen frames during a single interval. Intervals last 1 second by default. To change the polling interval duration, pass a positive duration, in milliseconds, to the interval(Duration) setting of SlowRenderingModuleConfiguration .

HTTP clients

The Android RUM agent includes instrumentation for the OkHttp and Volley HTTP clients. To activate the instrumentation, see HTTP instrumentation settings.

The HTTP client instrumentation collects the following OpenTelemetry HTTP attributes:

Name Type Examples
error.type String timeout,java.net.UnknownHostException,server_certificate_invalid,500
http.request.header.key string[] HTTP request headers, key being the normalized HTTP Header name (lowercase), the value being the header values. Example: [Fri, 13 Jun 2025 21:45:34 GMT]
http.request.method String HTTP request method.GET, POST, HEAD
http.request.resend_count int The ordinal number of request resending attempt (for any reason, including redirects)
http.response_content_length Integer 3495 (bytes)
http.response.header.key string[] HTTP response headers, key being the normalized HTTP Header name (lowercase), the value being the header values. Example:["application/json"]
http.response.status_code Integer 200, 404, 418
http.request.body.size Integer The size of the request payload, measured in bytes.
http.response.body.size Integer The size of the response payload, measured in bytes.
network.peer.address string Peer address of the network connection - IP address or Unix domain socket name.
network.peer.port int Peer port number of the network connection
network.protocol.name string OSI application layer or non-OSI equivalent. Example: http
network.protocol.version string The actual version of the protocol used for network communication
server.address String Name of the local HTTP server that received the request foo.bar
server.port Integer Port of the local HTTP server that received the request 80, 8080, 443.
url.full String https://foo.bar/address?q=value#hash

The HTTP instrumentation also collects the following attributes:

Name Type Description
component String Always http.
link.spanId String The span ID of the corresponding backend (APM) span, extracted from the Server-Timing header. See Link RUM with Splunk APM for more information. Note - If multiple valid server-timing headers are found, the last valid one is used.
link.traceId String The trace ID of the corresponding backend (APM) span, extracted from the Server-Timing header. See Link RUM with Splunk APM for more information. Note - If multiple valid server-timing headers are found, the last valid one is used.

Activity/fragment lifecycle monitoring

Activity/fragment lifecycle monitoring generates spans whenever an activity or fragment changes its lifecycle state. An activity/fragment lifecycle span can have one of the following names depending on its state.

Activity transitions (main callbacks; each maps to a lifecycle.action value):

  • created: onActivityCreated has run (including after a configuration change recreates the activity).

  • started: Activity has entered the started state (onActivityStarted).

  • resumed: Activity is interactive (onActivityResumed).

  • paused: Activity is no longer in the foreground (onActivityPaused).

  • stopped: Activity is no longer visible (onActivityStopped).

  • destroyed: Activity is being torn down (onActivityDestroyed).

Fragment transitions (main callbacks; order follows the Android fragment lifecycle):

  • attached: Fragment is associated with its host (onFragmentAttached).

  • created: Fragment's onCreate has completed (onFragmentCreated).

  • view_created: Fragment's view hierarchy exists (onFragmentViewCreated).

  • started: Fragment's onStart has run (onFragmentStarted).

  • resumed: Fragment is active (onFragmentResumed).

  • paused: Fragment is no longer resumed (onFragmentPaused).

  • stopped: Fragment's onStop has run (onFragmentStopped).

  • view_destroyed: Fragment's view was removed (onFragmentViewDestroyed).

  • destroyed: Fragment instance is destroyed (onFragmentDestroyed).

  • detached: Fragment is removed from its host (onFragmentDetached).

Pre and post values (API 29+ only)

If allowedEvents includes the pre/post set (for example, when using ALL_LIFECYCLE_EVENTS), you also get extra lifecycle.action values such as pre_created, post_created, pre_resumed, and post_resumed.

Data model

Activity/fragment lifecycle spans are named app.ui.lifecycle and contain the following attributes:

Attribute name Type Description
element.type String Kind of component: Activity or Fragment.
element.name String Simple class name of the activity or fragment (or a custom name if your app maps it in the UI layer).
element.id String Stable class-level identifier (fully qualified class name) for the activity or fragment.
lifecycle.action String Lifecycle transition, e.g. created, started, resumed, paused, stopped, destroyed, or for fragments attached, view_created, view_destroyed, detached, and when enabled, pre_*/post_* values on API 29+.

Interactions monitoring

Interactions monitoring collects the following attributes:

Name Type Description
action.name String Name of the UI element as defined by the end user.
target.type String Name of screen on which the event happens.
sender.type String UI element that calls the method.
event.type Enum The type of the event.

The following user interactions are automatically reported by this module:

  • Tap: A quick touch on the screen.

  • Double Tap: Two rapid taps in succession.

  • Long Press: Pressing and holding an item on the screen.

  • Pinch: Using two fingers to zoom in or out by moving them closer together or further apart.

  • Rotation: Using two fingers to rotate an item around a central point on the screen.

  • Focus: The active element on the screen that indicates the user's attention to a specific item.

  • HW Key Press: Utilizing hardware buttons for navigation or actions, such as volume up/down or the back button.

  • Keyboard Visibility: The appearance or disappearance of the on-screen (software) keyboard.

  • Rage Tap: Multiple rapid taps made in frustration.

App start monitoring

App start monitoring feature generates spans whenever the app performs a cold, warm, or hot start.

  • Cold starts happen when users open the app for the first time since booting the phone, or after the user has terminated the app.

  • Hot starts happen when the system brings an app to the foreground. Hot starts are faster than cold starts because the app is already loaded.

  • Warm starts happen when some of the operations that take place in a cold start are still happening. Warm starts are faster than cold starts, but slower than hot starts.

App start monitoring produces spans with the name AppStart and the following attributes:

Name Type Description

component

String

Always appstart.

start.type

String

The type of start. Can be cold, warm, or hot.

Navigation detection generates a span whenever the visible screen changes. Each navigation span is named app.ui.navigation and includes the following attributes for the new screen name, the previous screen name, and the source of the transition.

Attribute name Type Description
screen.name String Screen the user navigated to (activity/fragment simple class name, @NavigationElement name, manual track name, or a Compose route template).
last.screen.name String Previous screen before this navigation, when known. Omitted when there was no prior screen (e.g. first event in a session).
navigation.name String Navigation name. Typically the name of the application business logic segment the navigation enters; e.g. "UserLogin", "Settings", "Payment".
nav.graph String

(Jetpack compose only, when applicable)

Route of the parent navigation graph for the destination.
<route arguments> String

(Jetpack Compose only)

Route parameters defined in your app (e.g. userId). Values are extracted from the navigation arguments automatically. Internal framework keys are excluded.
<custom attributes> String (Optional) Extra attributes from the Navigation.track(screenName, attributes) API or from a NavigationEventProcessor (if configured).

Location data

Note: Splunk Observability Cloud calculates geographical metadata from the latitude and longitude, and then drops the latitude and longitude after processing the data.