Android RUM data model

Understand what RUM data the Splunk RUM agent collects from Android applications.

The Android agent for Splunk Real User Monitoring (RUM) collects the following types of data about your Android application.

Common data types

The Splunk RUM data model represents the following logical entities, following OpenTelemetry conventions:


Trace	A set of events triggered as a result of a single logical operation, distributed across various components of an application. Traces contain events that cross process, network, and security boundaries. A RUM trace can, for example, initiate when someone taps on a button to start an action on a website. If you use RUM and APM together, traces represent calls made between the downstream services that handle the requests initiated by the user action.
Span	An operation within a transaction. A single span includes the logical name, the start and end timestamp of the operation, and the events and attributes linked to the captured data. A span might have a reference to its parent span and zero or more causally-related spans. Spans have universal attributes and custom attributes.
Session	A collection of traces that correspond to the actions a single user takes when interacting with an application over a period of time. By default, a session lasts until 15 minutes passed from the last event captured in the session. The maximum session duration is 4 hours.
Interaction	Reflects the action the user conducts within the user interface. Common interaction types include mouse clicks, taps on a touch screen, and keyboard events.
User	By default, Splunk RUM doesn’t collect identity data. Mapping a trace to a specific user requires manual instrumentation. Users can be represented by their username, email addresses, or using a synthetic identifier. Synthetic representation is useful in situations where PII regulations do not allow users to be identified.

Basic properties

The following properties are common to all applications instrumented for Splunk RUM:


Name	Type	Description
`id`	String	Unique 64-bit identifier generated for the span within the trace.
`parentId`	String	Parent span ID. Absent if the span is the root span in a trace.
`name`	String	Logical operation the span represents.
`duration`	Number	Duration in microseconds.
`traceId`	String	Unique 128-bit identifier, set on all spans belonging to the trace.
`timestamp`	Number	Epoch microseconds of the start of the span. Can be absent if incomplete.
`tags`	Object	Additional context, allowing to search and analyze spans based on specific tags.
`annotations`	Array	Associates events that explain latency with the time they happened.

Default (global) attributes

By default, the Android RUM agent adds the following attributes to all spans:


Name	Description	Example
`session.id`	Session ID.	`1b93859337def61246e1edab0a41fba0`
`otel.scope.name`	The name of the instrumentation scope.	`SplunkRum`, `io.opentelemetry.lifecycle`
`screen.name`	The current screen name or `unknown`. Documented in: Navigation detection \| Screen name propagation.	`MainActivity`, `ShopingCart`
`network.carrier.icc`	Current network attributes.	`DE`
`network.carrier.mcc`		`310`
`network.carrier.mnc`		`001`
`network.carrier.name`		`LTE`
`network.connection.type`		`wifi`

Metrics

The following tables list all of the metrics available in Splunk RUM for Android. All errors in Splunk RUM have the dimension sf_error=true.

For more information on app startup metrics as defined by Android, see App startup time in the Android Developers documentation.


Metric name	UI name	Description
`rum.workflow.count`	Custom Event Count	The total number of spans with the selected custom event in the given time range.
`rum.workflow.time.ns.p75`	Custom Event Duration	The p75 time in nanoseconds of spans with the selected custom event in the given time range.
`rum.crash.count`	Mobile crash	Total number of crashes in the given time range.
`rum.app_error.count`	App error	Total number of ANRs, handled exceptions, and reported errors in the given time range.
`rum.cold_start.time.ns.p75`	Cold start time	The p75 time in nanoseconds of cold starts in the given time range.
`rum.cold_start.count`	Cold start count	Total number of cold starts in the given time range.
`rum.warm_start.count`	Warm start count	Total number of warm starts in the given time range.
`rum.warm_start.time.ns.p75`	Warm start time	The p75 time in nanoseconds for a warm start.
`rum.hot_start.count`	Hot start count	Total number of hot starts in the given time range.
`rum.hot_start.time.ns.p75`	Hot start time	The p75 time in nanoseconds for a hot start.
`rum.resource_request.count`	Network or back-end requests/errors	The total number of network requests in a given time range.
`rum.resource_request.time.ns.p75`	Network or back-end latency	The p75 time in nanoseconds for back-end latency in the given time range.

Resource attributes

By default, the Android RUM agent adds the following resource attributes to all spans:


Name	Description	Examples
`app`	Required. Application name that can be set in the `AgentConfiguration` or gathered programatically.	`NewPipe`, `Wikipedia`
`app.version`	Required. Application version that can be set in the AgentConfiguration or is gathered programatically.	`1.0.0`, `0.3.0-alpha`
`deployment.environment`	Required. Name of the deployment environment that must be set in `AgentConfiguration`.	`test`, `staging`, `production`, `any-string`
`device.manufacturer`	Required. The name of the device manufacturer. Semantic conventions	`LG`, `Samsung`
`device.model.identifier`	Required. The model identifier for the device. It's recommended this value represents a machine-readable version of the model identifier rather than the market or consumer-friendly name of the device.	`SM-G920F`
`device.model.name`	Required. The marketing name for the device model. It's recommended this value represents a human-readable version of the device model rather than a machine-readable alternative.	`Samsung Galaxy S6`
`os.description`	Required. Human readable (not intended to be parsed) OS version information.	`Android Version 14 (Build UE1A.230829.036.A4 API level 34)`
`os.name`	Required. Human readable operating system name.	`Android`
`os.type`	Required. The operating system type.	`linux`
`os.version`	Required. The version string of the operating system	`14`
`rum.sdk.version`	Required. Semantic version of the agent.	`0.40.0-alpha`, `1.0.0`

Instrumentation module attributes

The Android RUM agent collects the following data using its instrumentation modules. To activate or deactivate specific instrumentation modules, see Instrumentation settings.

Crash reporting

The Android RUM agent adds the following crash reporting attributes to spans that represent uncaught exceptions:


Name	Type	Description
`thread.id`	Integer	ID of the current managed thread, as opposed to the operating system thread ID.
`thread.name`	String	Name of the thread.
`exception.message`	String	The message of the exception.
`exception.type`	String	The type of the exception.
`exception.stacktrace`	String	The stack trace for the exception.
`exception.escaped`	String	Always `true`, denoting the uncaught exception, such as a crash occurring.
`component`	String	Always `crash`.
`service.application_id`	String	Application ID of the app: See the definition of `applicationId` in the Android Studio developer documentation.
`service.version_code`	String	Version code of the application: See the definition of `versionCode` in the Android Studio developer documentation.
`splunk.build_id`	String	This is an optional attribute. This is added when minification is enabled for pre-production builds where version code is not updated across app builds, in which case this attribute is used to uniquely identify each build.

Network monitoring

Network monitoring produces spans with the name network.change and the following attributes:


Name	Type	Description
`network.carrier.icc`	String	The ISO 3166-1 alpha-2 2-character country code associated with the mobile carrier network. For example, `US`, `DE.`
`network.carrier.mcc`	String	The mobile carrier country code.
`network.carrier.mnc`	String	The mobile carrier network code.
`network.carrier.name`	String	The name of the mobile carrier. For example, `T-Mobile`, `AT&T`.
`network.connection.type`	String	Internet connection type. Possible values are: `unavailable`, `cell`, `wifi`, `unknown`, `vpn`.
`network.status`	String	Network status. Possible values are `lost` or `available`.

Application not responding (ANR)

Application not responding (ANR) event detection generates spans whenever the main application thread is unresponsive for more than 5 seconds.

ANR produces spans with the name ANR and the following attributes:


Name	Type	Description
`component`	String	Always `error`.
`exception.stacktrace`	String	A stack trace as a string in the natural representation for the language runtime.
`service.application_id`	String	Application ID of the app: See the definition of `applicationId` in the Android Studio developer documentation.
`service.version_code`	String	Version code of the application: See the definition of `versionCode` in the Android Studio developer documentation.
`splunk.build_id`	String	This is an optional attribute. This is added when minification is enabled for pre-production builds where version code is not updated across app builds, in which case this attribute is used to uniquely identify each build.

Slow rendering detection

Slow rendering detection generates spans whenever it detects a slow or frozen frame render. Frame rendering is slow if its duration exceeds 16 milliseconds, and frozen if it exceeds 700 milliseconds.

Slow rendering detection generates up to two spans on every interval: a span named slowRenders which counts slow frames, and a span named frozenRenders which counts frozen frames.

Slow rendering detection spans have the following attribute:


Name	Type	Description
`count`	Integer	Number of observed slow or frozen frames during a single interval. Intervals last 1 second by default. To change the polling interval duration, pass a positive duration, in milliseconds, to the `interval(Duration)` setting of `SlowRenderingModuleConfiguration` .

HTTP clients

The Android RUM agent includes instrumentation for the OkHttp and Volley HTTP clients. To activate the instrumentation, see HTTP instrumentation settings.

The HTTP client instrumentation collects the following OpenTelemetry HTTP attributes:


Name	Type	Examples
`error.type`	String	`timeout`,`java.net.UnknownHostException`,`server_certificate_invalid`,`500`
`http.request.header.<key>`	string[]	HTTP request headers, `<key>` being the normalized HTTP Header name (lowercase), the value being the header values. Example: `[Fri, 13 Jun 2025 21:45:34 GMT]`
`http.request.method`	String	HTTP request method.`GET`, `POST`, `HEAD`
`http.request.resend_count`	int	The ordinal number of request resending attempt (for any reason, including redirects)
`http.response_content_length`	Integer	`3495` (bytes)
`http.response.header.<key>`	string[]	HTTP response headers, `<key>` being the normalized HTTP Header name (lowercase), the value being the header values. Example:`["application/json"]`
`http.response.status_code`	Integer	`200`, `404`, `418`
`network.peer.address`	string	Peer address of the network connection - IP address or Unix domain socket name.
`network.peer.port`	int	Peer port number of the network connection
`network.protocol.name`	string	OSI application layer or non-OSI equivalent. Example: `http`
`network.protocol.version`	string	The actual version of the protocol used for network communication
`server.address`	String	Name of the local HTTP server that received the request `foo.bar`
`server.port`	Integer	Port of the local HTTP server that received the request `80`, `8080`, `443`.
`url.full`	String	`https://foo.bar/address?q=value#hash`

The HTTP instrumentation also collects the following attributes:


Name	Type	Description
`component`	String	Always `http`.
`link.spanId`	String	The span ID of the corresponding backend (APM) span, extracted from the `Server-Timing` header. See Link RUM with Splunk APM for more information. Note - If multiple valid server-timing headers are found, the last valid one is used.
`link.traceId`	String	The trace ID of the corresponding backend (APM) span, extracted from the `Server-Timing` header. See Link RUM with Splunk APM for more information. Note - If multiple valid server-timing headers are found, the last valid one is used.

Activity lifecycle monitoring

Activity lifecycle monitoring generates spans whenever an activity changes its state. An activity lifecycle span can have one the following names depending on its state:

Created: Activity starts for the first time.
Restarted:Activity restarts after being stopped.
Resumed: Activity resumes after a pause.
Paused: Activity is paused.
Stopped: Activity stops.
Destroyed: Activity is destroyed.

Activity lifecycle spans contain the following attributes:


Name	Type	Description
`component`	String	Always `ui`.
`activityName`	String	Name of the activity class.

Fragment lifecycle monitoring

Fragment lifecycle monitoring generates spans whenever a fragment changes its state. A fragment lifecycle span can have one the following names depending on its state:

Created: Before the fragment gets attached to the Android context.
Restored: Fragment recreates its view.
Resumed: Fragment is resumed after a pause.
Paused: Fragment is paused.
ViewDestroyed: The view of the fragment is destroyed.
Destroyed: Fragment is destroyed.
Detached: Fragment is detached from the Android context.

Fragment lifecycle spans contain the following attributes:


Name	Type	Description
`component`	String	Always `ui`.
`fragmentName`	String	Name of the fragment class.

Interactions monitoring

Interactions monitoring collects the following attributes:


Name	Type	Description
`action.name`	String	Name of the UI element as defined by the end user.
`target.type`	String	Name of screen on which the event happens.
`sender.type`		UI element that calls the method.
`event.type`	Enum	The type of the event.

The following user interactions are automatically reported by this module:

Tap: A quick touch on the screen.
Double Tap: Two rapid taps in succession.
Long Press: Pressing and holding an item on the screen.
Pinch: Using two fingers to zoom in or out by moving them closer together or further apart.
Rotation: Using two fingers to rotate an item around a central point on the screen.
Focus: The active element on the screen that indicates the user's attention to a specific item.
HW Key Press: Utilizing hardware buttons for navigation or actions, such as volume up/down or the back button.
Keyboard Visibility: The appearance or disappearance of the on-screen (software) keyboard.
Rage Tap: Multiple rapid taps made in frustration.

App start monitoring

App start monitoring feature generates spans whenever the app performs a cold, warm, or hot start.

Cold starts happen when users open the app for the first time since booting the phone, or after the user has terminated the app.
Hot starts happen when the system brings an app to the foreground. Hot starts are faster than cold starts because the app is already loaded.
Warm starts happen when some of the operations that take place in a cold start are still happening. Warm starts are faster than cold starts, but slower than hot starts.

App start monitoring produces spans with the name AppStart and the following attributes:


Name	Type	Description
`component`	String	Always `appstart`.
`start.type`	String	The type of start. Can be `cold`, `warm`, or `hot`.

Location data

Note: Splunk Observability Cloud calculates geographical metadata from the latitude and longitude, and then drops the latitude and longitude after processing the data.

Documentation