iOS RUM data model

Understand what RUM data the Splunk RUM agent collects from iOS applications.

The iOS RUM library includes a package that collects the following types of data about your iOS application.

Common data types

The Splunk RUM data model represents the following logical entities, following OpenTelemetry conventions:


Trace	A set of events triggered as a result of a single logical operation, distributed across various components of an application. Traces contain events that cross process, network, and security boundaries. A RUM trace can, for example, initiate when someone taps on a button to start an action on a website. If you use RUM and APM together, traces represent calls made between the downstream services that handle the requests initiated by the user action.
Span	An operation within a transaction. A single span includes the logical name, the start and end timestamp of the operation, and the events and attributes linked to the captured data. A span might have a reference to its parent span and zero or more causally-related spans. Spans have universal attributes and custom attributes.
Session	A collection of traces that correspond to the actions a single user takes when interacting with an application over a period of time. By default, a session lasts until 15 minutes passed from the last event captured in the session. The maximum session duration is 4 hours.
Interaction	Reflects the action the user conducts within the user interface. Common interaction types include mouse clicks, taps on a touch screen, and keyboard events.
User	By default, Splunk RUM doesn’t collect identity data. Mapping a trace to a specific user requires manual instrumentation. Users can be represented by their username, email addresses, or using a synthetic identifier. Synthetic representation is useful in situations where PII regulations do not allow users to be identified.

Basic properties

The following properties are common to all applications instrumented for Splunk RUM:


Name	Type	Examples
`SpanId`	String	Unique 64-bit identifier generated for the span within the trace.
`ParentSpanId`	String	Parent span ID. Absent if the span is the root span in a trace.
`name`	String	Logical operation the span represents.
`duration`	Number	Duration in microseconds.
`traceId`	String	Unique 128-bit identifier, set on all spans belonging to the trace.
`timestamp`	Number	Epoch microseconds of the start of the span. Can be absent if incomplete.
`tags`	Object	Additional context, allowing to search and analyze spans based on specific tags.
`TraceFlags`	Struct	Represents global trace options. Options are propagated to all child spans and determine features such as whether a span is traced.
`TraceState`	Struct	Carries tracing-system specific context in a list of key-value pairs.
`SpanKind`	Enum	Type of span. Use it to set additional relationships between spans. The default value is `Internal`. Supported values are: Internal Server Client Producer consumer

The following table describes each value of SpanKind:


Name	Description
`Internal`	Default value. Indicates that the span is used internally.
`Server`	Indicates that the span covers server-side handling of an RPC or other remote request.
`Client`	Indicates that the span covers the client-side wrapper around an RPC or other remote request.
`Producer`	Indicates that the span describes producer sending a message to a broker.
`Consumer`	Indicates that the span describes consumer receiving a message from a broker.

Default (global) attributes

By default, the iOS RUM library adds the following attributes to all spans:


Name	Type	Examples
`session.id`	Session ID.	`1b93859337def61246e1`, `edab0a41fba0`
`otel.scope.name`	The name of the instrumentation scope. The scope name can differ for specific instrumentation.	`SplunkRum`
`screen.name`	The current screen name or unknown.	LoginViewController

Metrics

The following tables list all of the metrics available in Splunk RUM for iOS.


Metric name	UI name	Description
`rum.workflow.count`	Custom Event Count	The total number of spans with the selected custom event in the given time range.
`rum.workflow.time.ns.p75`	Custom Event Duration	The p75 time in nanoseconds of spans with the selected custom event in the given time range.
`rum.crash.count`	Mobile crash	A crash happens when a user encounters an error and has to exit the app.
`rum.app_error.count`	App error	Total number of reported errors in the given time range.
`rum.resource_request.count`	Network or back-end requests/errors	The total number of network requests in a given time range.
`rum.resource_request.time.ns.p75`	Network back-end latency	The p75 time in nanoseconds for the network request latency in the given time range.
`rum.cold_start.time.ns.p75`	Cold start time	The p75 time in nanoseconds of cold starts in the given time range.
`rum.cold_start.count`	Cold start count	Total number of cold starts in the given time range.
`rum.hot_start.count`	Hot start count	Total number of hot starts in the given time range.
`rum.hot_start.time.ns.p75`	Hot start time	The p75 time in nanoseconds for a hot start.

Resource attributes

By default, the iOS RUM library adds the following resource attributes to all spans:


Name	Description	Example
`app`	Application name that can be set in the `AgentConfiguration` or is gathered programmatically.	`com.splunk.app`
`app.version`	Application version that can be set in the `AgentConfiguration` or is gathered programmatically.	`1.0.0`, `0.3.0-alpha`
`deployment.environment`	Name of the deployment environment that must be set in `AgentConfiguration`.	`test`, `staging`, `production`, `<any String>`
`device.manufacturer`	The name of the device manufacturer.	`Apple`
`device.model.identifier`	The model identifier for the device. It's recommended this value represents a machine-readable version of the model identifier rather than the market or consumer-friendly name of the device.	`iPhone3, 4`
`device.model.name`	The marketing name for the device model. It's recommended this value represents a human-readable version of the device model rather than a machine-readable alternative.	`iPhone 6s Plus`
`os.description`	Human readable (not intended to be parsed) OS version information.	`iOS Version 18.5 (Build 22F77)`
`os.name`	Human readable operating system name.	`iOS`, `iPadOS`
`os.type`	The operating system type.	`darwin`
`os.version`	The version string of the operating system.	`18.5`
`rum.sdk.version`	Semantic version of the agent.	`2.0.0`

Instrumentation module attributes

The iOS RUM library collects the following data using its instrumentation modules. To activate or deactivate specific instrumentation modules, see Instrumentation settings.

Crash reporting

The iOS RUM library collects the following data using its instrumentations. To activate or deactivate specific instrumentations, see Instrumentation settings.

Network monitoring

Network monitoring produces spans with the name network.change and the following attributes:


Name	Type	Description
`network.status`	String	Network status. Either `lost` or `available`.
`network.connection.type`	String	Connection type. Possible values are: `unavailable`, `cell`, `wifi`, `unknown`, `vpn`.
`network.connection.subtype`	String	If network is cellular then it specifies type of cellular connection.

Slow rendering detection

The agent detects slow and frozen UI frame renders by periodically checking frame-rate performance.This feature generates two distinct span types, slowRenders and frozenRenders, to report the total count of each type of event observed during a 1-second reporting interval.

Unlike fixed-threshold detection, the iOS agent uses the system's CADisplayLink to dynamically identify slow and frozen frames relative to the device's current target frame rate. There are no fixed number of milliseconds that define slow and frozen; rather there is an internal fixed tolerancePercentage for slow frames and a fixed multiplier for frozen frames.

Frames that do not render within the system's expected timeframe (a value that varies according to system conditions) and exceed the expected duration by the fixed tolerancePercentage of 0.15 are reported as slow frames. Frames that exceed the system's expected duration for a frame by the fixed multiplier of 40x are reported as frozen frames.

Slow and frozen frames are aggregated in respective categories and reported as counts for each, with the reporting happening at intervals of one second if there is anything to report.

These spans have the following attributes:


Name	Type	Description
`component`	String	Identifies the component generating the span. Always `ui`.
`count`	Integer	Number of observed frames of the given type (slow or frozen) during a single interval. Intervals last 1 second by default.

Crash reporting

The iOS RUM library adds the following crash reporting attributes to spans that represent uncaught exceptions:


Name	Type	Description
`thread.id`	Integer	ID of the current managed thread, as opposed to the operating system thread ID.
`exception.message`	String	The message of the exception.
`exception.type`	String	The type of the exception.
`exception.threads`	Array	An array of elements containing data about one thread in the process, including a `stackFrame` array.
`exception.images`	Array	An array of elements containing data about the code image. There is one element for each image referenced in `exception.threads`.
`component`	String	Always `crash`.
`crash.timestamp`	NSDate	Date and time when the crash report is generated.
`crash.observedTimestamp`	NSDate	Date and time when the crash report is sent.
`crash.isNative`	Boolean	If `false`, code is being executed in an emulator such as Rosetta.
`crash.address`	Integer	Address of the faulty instruction.
`crash.processPath`	String	The full path to the crashed app on the device.
`crash.batteryLevel`	String	Formatted battery level. For example, `"87.3%"`.
`crash.freeMemory`	String	Formatted free memory available. For example, `"31.88 GB"`.
`crash.freeDiskSpace`	String	Formatted free disk space available. For example, `"691.96 GB"`.
`crash.app.version`	String	Full version of the crashed application. For example, `"1.0"`.
`crash.os.version`	String	Version of iOS in use. For example, `"16.4"`.

HTTP clients

The iOS RUM library includes instrumentation for the URLSession clients. To activate the instrumentation, see link to iOS Unified Agent Doc Updates (Private Preview) | Module Configurations <Replace iOS RUM features> here.

The HTTP client instrumentation collects the following OpenTelemetry HTTP attributes:


Name	Type	Examples
`http.request.method`	String	`GET`, `POST`, `HEAD`
`url.full`	String	`https://foo.bar/address?q=value#hash`
`http.response.status_code`	Integer	`200`, `404`, `418`
`http.response_content_length`	Integer	`3495` (bytes)
server.address	String	Name of the local HTTP server that received the request. Example: `foo.bar`

The HTTP instrumentation also collects the following attributes:


Name	Type	Description
`component`	String	Always `http`.
`link.traceId`	String	The trace ID of the corresponding backend (APM) span, extracted from the `Server-Timing` header. See Link RUM with Splunk APM.
`link.spanId`	String	The span ID of the corresponding backend (APM) span, extracted from the `Server-Timing` header. See Link RUM with Splunk APM.

UI actions monitoring

UIAction monitoring collects the following attributes:


Name	Type	Description
`action.name`	String	Name of the UI element as defined by the end user.
`target.type`	String	Name of screen on which the event happens.
`sender.type`		UI element that calls the method.
`event.type`	Enum	The type of the event.

Screen transitions monitoring

Unavailable for preview.

App start monitoring

App start monitoring feature generates spans whenever the app performs a cold, warm, or hot start.

Cold starts happen when users open the app for the first time since booting the phone, or after the user has terminated the app.
Warm starts happen when app was prewarmed, launched in the background first. Warm starts are faster than cold starts
Hot starts happen when the system brings an app to the foreground. Hot starts are faster than warm starts because the app is already loaded.

App start monitoring produces spans with the name AppStart and the following attributes:


Name	Type	Description
`component`	String	Always `appstart`.
`start.type`	String	The type of start. Can be `cold`, or `hot`.

The iOS RUM library adds the following crash reporting attributes to spans that represent uncaught exceptions:


Name	Type	Description
`thread.id`	Integer	ID of the current managed thread, as opposed to the operating system thread ID.
`exception.message`	String	The message of the exception.
`exception.type`	String	The type of the exception.
`exception.threads`	Array	An array of elements containing data about one thread in the process, including a `stackFrame` array.
`exception.images`	Array	An array of elements containing data about the code image. There is one element for each image referenced in `exception.threads`.
`component`	String	Always `crash`.
`crash.timestamp`	NSDate	Date and time when the crash report is generated.
`crash.observedTimestamp`	NSDate	Date and time when the crash report is sent.
`crash.isNative`	Boolean	If `false`, code is being executed in an emulator such as Rosetta.
`crash.address`	Integer	Address of the faulty instruction.
`crash.processPath`	String	The full path to the crashed app on the device.
`crash.batteryLevel`	String	Formatted battery level. For example, `"87.3%"`.
`crash.freeMemory`	String	Formatted free memory available. For example, `"31.88 GB"`.
`crash.freeDiskSpace`	String	Formatted free disk space available. For example, `"691.96 GB"`.
`crash.app.version`	String	Full version of the crashed application. For example, `"1.0"`.
`crash.os.version`	String	Version of iOS in use. For example, `"16.4"`.

Network monitoring

Network monitoring produces spans with the name network.change and the following attributes:


Name	Type	Description
`network.status`	String	Network status. Either `lost` or `available`.
`network.connection.type`	String	Connection type. Possible values are: `unavailable`, `cell`, `wifi`, `unknown`, `vpn`.
`network.connection.subtype`	String	If network is cellular then it specifies type of cellular connection.

Application Not Responding (ANR)

Slow rendering detection

Unlike fixed-threshold detection, the Splunk RUM iOS agent uses the system's CADisplayLink to dynamically identify slow and frozen frames relative to the device's current target frame rate.

Slow renders: A slow render is a single frame that takes slightly longer to display than the device expects. The detection is dynamic and adapts to the device's target frame rate (e.g., 60Hz, 120Hz).
A frame is flagged as slow if its duration exceeds the expected time for one frame plus a 15% tolerance. For example, with a 60Hz display rate, where a frame is expected every ~16.7ms, any frame taking longer than ~19.2ms would be flagged as slow.
Frozen renders: A frozen render indicates a more severe UI stall, where the application stops rendering new frames altogether.
A frozen render event is recorded if the UI take 40 times longer than the expected duration (a multiplier of 40x).

These signals have the following attributes:


Name	Type	Description
`component`	String	Identifies the component generating the span. Always `ui`.
`count`	Integer	Number of observed frames of the given type (slow or frozen) during a single interval. Intervals last 1 second by default.

HTTP clients

The iOS RUM library includes instrumentation for the URLSession clients. To activate the instrumentation, see Network instrumentation.