Configure call graph support and AlwaysOn Profiling for the .NET combined agent

Reference information for configuring call graph support and AlwaysOn Profiling for the .NET combined agent.

Configure call graph support when migration readiness depends on call graph data. Do not treat call graph parity as verified until you confirm the application runtime, .NET combined agent version, platform, and hosting model.

To enable call graph reporting and AlwaysOn profiling for .NET applications in Splunk Observability Cloud, you must configure specific environment variables for the Splunk Distribution of OpenTelemetry .NET.

Splunk Observability Cloud distinguishes between AlwaysOn Profiling (continuous flame graphs) and Call Graph Profiling (snapshot-based deep trace insights). You typically enable both for full visibility.

Prerequisites

  • Agent Version: Use Splunk Distribution of OpenTelemetry .NET version 1.3.0 or higher.
  • Runtime: The agent supports .NET 6.0 and higher. The agent supports CPU-only profiling for .NET Framework starting from version 1.13.0.
  • License: Call Graph Profiling requires an active AlwaysOn Profiling license within your Splunk organization.

Set core environment variables

Set these environment variables (or their equivalents on your platform) for the agent to authenticate and identify your service in the Splunk platform. For descriptions, see Enable the combined mode for .NET agent.

  • SPLUNK_ACCESS_TOKEN
  • SPLUNK_REALM
  • OTEL_SERVICE_NAME
  • OTEL_RESOURCE_ATTRIBUTES

Activate AlwaysOn Profiling (continuous)

AlwaysOn Profiling provides a high-level view of CPU and memory usage across your entire service. Set these environment variables (or their equivalents on your platform). For descriptions, see Enable the combined mode for .NET agent.

You must use an OpenTelemetry Collector for AlwaysOn Profiling; you cannot use direct-route ingestion.

  • SPLUNK_PROFILER_ENABLED: Set to true to enable CPU profiling.
  • SPLUNK_PROFILER_MEMORY_ENABLED: Set to true to enable memory profiling (requires you to enable CPU profiling first).
  • SPLUNK_PROFILER_CALL_STACK_INTERVAL: The interval (in milliseconds) at which the agent samples call stacks. Default: 10000 (10 seconds).

Activate Call Graph Profiling (snapshots)

Call Graph Profiling provides deep, code-level insights specifically linked to individual traces. The Call Graph tab in the Trace View displays this information. Set these environment variables (or their equivalents on your platform). For descriptions, see Enable the combined mode for .NET agent.

  • SPLUNK_SNAPSHOT_PROFILER_ENABLED: Set to true to enable the snapshot profiler.
  • SPLUNK_SNAPSHOT_SAMPLING_INTERVAL: The frequency of snapshots. Default: 40ms. Lowering this increases detail but adds overhead.
  • SPLUNK_SNAPSHOT_SELECTION_PROBABILITY: The probability (0.0 to 1.0) that the agent selects a trace for snapshotting. Default: 0.01 (1%). Do not set this above 0.10.
  • SPLUNK_PROFILER_EXPORT_INTERVAL: The interval for exporting collected stack data. Default: 500ms.
Note:

Note on Configuration Logic: If you enable both, SPLUNK_PROFILER_CALL_STACK_INTERVAL must exceed SPLUNK_SNAPSHOT_SAMPLING_INTERVAL and remain a multiple of it.

Implementation example

If you run your application in a Docker container or a shell environment, your configuration looks like this:

CODE 
# Core Configuration
export OTEL_SERVICE_NAME="my-dotnet-service"
export SPLUNK_ACCESS_TOKEN="<your_token>"
export SPLUNK_REALM="us0"

# AlwaysOn Profiling
export SPLUNK_PROFILER_ENABLED=true
export SPLUNK_PROFILER_MEMORY_ENABLED=true

# Call Graph (Snapshot) Profiling
export SPLUNK_SNAPSHOT_PROFILER_ENABLED=true
export SPLUNK_SNAPSHOT_SAMPLING_INTERVAL=20
export SPLUNK_SNAPSHOT_SELECTION_PROBABILITY=0.05