Filter your data by tags in Splunk RUM

Use tags to filter data and refine the search results to gain meaningful insights in Splunk RUM.

Filtering your data by tags helps you refine the scope of your search results and glean meaningful insights. In Splunk RUM, you can filter both indexed and unindexed tags using the equal sign operator ( = ) and unequal sign operator ( != ).

Understand the results of your search

The following examples show how search results differ depending on the combination of filters you select.

Apply multiple filters under the same operator

You can apply multiple filters under the same operator. For example, the following image shows how to select multiple browser types. The results from this search include metrics, events, or sessions originating from Chrome, Electron, Firefox, or Safari.

This shows how to apply multiple filters under the same = sign operator.

Apply separate filters

Suppose you want to monitor the checkout latency of your site on Chrome. If you apply the following filters, the results of the search include metrics, events, or sessions from the custom event Checkout that occurred on a Chrome browser.

This shows how to select two different filters, in this case Browser=Chrome and Custom Event Name = Checkout.

Search for global attributes

Global attributes are key-value pairs added to all reported data. Global attributes are useful for reporting app or user-specific values as tags. You can create global attributes either at the time of library initialization, or afterwards. Span attributes are custom attributes that you can add to specific spans. Custom events capture logic for a specific workflow you define, for example a checkout workflow. For more, see Create custom events.

To search for global attributes, enter the tag and value into the filter bar like in the following image:

This shows how to search for a global attribute. In this case, enduser.id=123.

How to set global attributes

For instructions on how to set global attributes, see the instrumentation documentation for the following platforms:

Global attributes examples

Suppose you want to identify users, you can add global attributes enduser.id and enduser.role. You might also consider adding environment and app.version.

Span attributes example

Suppose you have have an autofill function in your code, and you want to know whether it’s turned on or off. You can use one of the following settings as a span attribute:

  • {'autocomplete': 'true'}

  • {'autocomplete': 'false'}

  • {'autocomplete_status': 'on'}

  • {'autocomplete_status': 'off'}

Search for unindexed tags

To search for unindexed tags, enter the tag and value into the filter bar. This following animation shows an example from the fictitious Buttercup Industries on how to filter by an unindexed tag called ButtercupSession.

This shows how to search for unindexed tags by entering the value directly into the filter box.

After entering a value in the filter, a Session Search page appears. The page contains a list of sessions that match the filter criteria.

Undefined tag values

Sometimes, you might see a message in the UI that says Tag value undefined. This might happen because some data was missing when it was ingested by Splunk RUM.

Try these steps to troubleshoot:

  • If the environment tag is undefined, try setting it in the instrumentation by following the steps here: Instrument mobile and web applications for Splunk RUM.

  • If the tag is related to a geo location that is calculated based off of an IP address, this data could be missing if the user is on VPN.

Search for indexed tags

Splunk RUM provides the ability to filter on the following tags out of the box:

Splunk RUM for Browser

Splunk RUM for Mobile

  • Url name

  • Operation

  • HTTP Method and status code

  • Custom event name

  • Browser and version

  • OS name and version

  • City, region, country

  • Network connection

  • HTTP method and status code

  • Screen name

  • Operation

  • Custom event name

  • URL name

  • App version

  • Device name

  • Platform

  • OS name and version

  • City, region, country

Why are some tag values undefined?

You might see the following message in the Splunk RUM Tag Spotlight page: Tag value undefined. This means that there were no tag values associated with the span. There are many reasons why a tag value might be undefined. For example:

  • If a URL doesn’t load because of a poor network connection, the HTTPS status codes might be unavailable. This situation results in the message Tag value undefined.

  • For some errors, the error type, message, or stack trace could be unavailable. In this scenario, you might see the following message: JS Errors without type, message or stack trace. This means that the spans were missing information that were required to compute the ErrorId when they were ingested into Splunk RUM.

Examples on how to filter by tags

The following examples outline how you can filter tags in Splunk RUM.

Search by status code

Suppose you want to filter by status code, excluding 200s. You can apply a filter like in the image below. Using the wildcard ( * ), you can search for all status codes starting with 2 and then using the != operator, you can filter out the success status code.

This shows how to search for multiple tag values using the * wildcard.

Similarly, if you want to search for all 400 error responses but not 404 responses, you can apply filters like these:

This shows how to search for multiple tag values using the * wildcard.

Search for a specific browser version

This example shows how to search for all data from a browser version 99.0 excluding 1 release.

This shows how to search for multiple tags at the same time.

Include all results or exclude all results

This search returns results for all browser versions.

This shows how to search for all results for a filter.

If you want to search for results with no browser version, you can apply the filter BrowserVersion != *.