View dependencies in the service map in Splunk APM

Learn about the service map displays for your services in Splunk APM.

The service map displays the dependencies and connections among your instrumented and inferred services in APM. The map is dynamically generated based on your selections in the time range, environment, business transaction, service, and tag filters. You can use the service map to identify dependencies, performance bottlenecks, and error propagation.

For a detailed scenario involving the service map, see Scenario: Kai investigates the root cause of an error with the Splunk APM service map.

See Analyze the performance of inferred services to learn more about inferred services in APM.

The following screenshot shows an example service map:

An example of the service map in Splunk APM Service Map.

Access the service map

Use these steps to access the service map in Splunk APM:

In the Splunk Observability Cloud main menu, select APM, then Service map.
(Optional) Select Switch to Classic Map to switch to the lateral service map layout. The default constellation view of services displays a larger view of your environment, and helps you quickly assess service performance.

What can I do with the service map?

Using the service map, you can:

Hover over a node or edge to view a pop-up chart of the request, error, and latency (RED) metrics for that node or edge.
Select any node in the service map to see charts for that node in the service panel.
Select on a node in the service map to isolate that node and its immediate dependencies in the service map.
Use the Breakdown selector to break the service activity down by any indexed span tag. See Perform breakdowns in the service map to learn more.
Select any chart in this view to show example traces that match the parameters of the chart.

You can also use the service map as a starting point for monitoring or troubleshooting scenarios:

To get real-time monitoring insights on the service, select View Dashboard in the side panel to view the built-in service dashboard. See Track service performance using dashboards in Splunk APM to learn more.
To do more extensive troubleshooting, select the Tag Spotlight tab in the side panel to open Tag Spotlight. See Analyze service performance with Tag Spotlight to learn more.

Search the service map

Note: This feature is only available in the constellation view of the service map.

Select the Search by service field to search for a specific service or display an alphabetized list of your services. When you select a service from the list, the service map automatically selects and zooms in on the selected service.

Filter the service map

Select the filter menu to change the maximum or the types of services that display on the service map. The service map shows all service types by default. There is also a default maximum of 50 services.

Perform breakdowns in the service map

The following screenshot shows an example service map in which the paymentservice node is broken down by endpoint, showing that errors with the payment service are occurring in the /Charge endpoint.

An example of the service map in Splunk APM. The paymentservice node is broken down by endpoint, showing that errors with that service are arising in the /Charge endpoint.

The following image shows the same service map with an additional breakdown on the checkoutservice by endpoint. This shows that the errors occurring in the /Charge endpoint of the paymentservice originate in the /placeOrder endpoint of the checkoutservice.

This screenshot shows an example of the service map in Splunk APM. The ``paymentservice`` and ``checkoutservice`` nodes are broken down by endpoint.

To breakdown the service map, do these things:

Select a service you’re interested in.
In the service tab, select Breakdown and select an option from the menu. This breaks down your view of the service by the feature you select. For example, select Endpoint then Latency (P90) to break the service node down into its endpoints, ranked from highest to lowest by 90th percentile latency. If there are more than 5 breakdown values, the breakdown shows the top 5 and groups the remainder into a node labeled <other>.
(Optional) Select a node within the breakdown to further break down the visualization by another feature.

You can configure specific metadata to activate Related Content in your service map. Related Content automatically correlates data between APM, Infrastructure Monitoring, and Log Observer to pass filters around Splunk Observability Cloud.

When configured, you can select tiles in the Related Content bar to seamlessly navigate from 1 view to another in Splunk Observability Cloud. The following animation shows a user navigating from APM to Infrastructure Monitoring. See Related Content in Splunk Observability Cloud for information about how to configure related content to display in your service map.

Using Related Content in Splunk Observability Cloud.

Monitor service health in the service map

On the service map, the health of a service is represented by a colored ring around the service. The colored ring correlates to the following health statuses.


Health status name	Health status color	Description
No health status	Gray	The service has no existing alerts.
Warning	Yellow	The service: Has at least one minor or warning alert. Has no major or critical alerts.
Critical	Red	The service has at least one major or critical alert.

Health status is determined by the highest severity alert that exists for the service, not the number of alerts that exist for the service.

For example:

Consider a service that has 3 minor alerts and 20 info alerts. This service would have a Warning (yellow) health status because it has 0 major or critical alerts and at least 1 minor alert.
Consider a service that has 1 critical alert and 4 minor alerts. This service would have a Critical (red) health status since it has at least 1 critical alert.

Service health statuses are based on the alerts triggered by custom and AutoDetect detectors. For more information, see Introduction to alerts and detectors in Splunk Observability Cloud and Intro to AutoDetect alerts and detectors.

View alerts for a service in the service map

Complete the following steps to view the alerts for a service in the service map.

Select a service with a health status, which is represented by a colored ring around the service. For more information about service health statuses, see Monitor service health in the service map.
Select the health icon next to the service name. A panel displays with the health status name and a list of the alerts for the service.
Select an alert from the list to view the alert details.

Group services in the service map

Note:

This feature is only available in the constellation view of the service map.

To group services by a custom indexed span tag, you must first Add context to spans with span tags in Splunk APM and then Index span tags to create Troubleshooting MetricSets. You can group services by the service.namespace span tag, which is an OpenTelemetry convention. For more information, see Service in the OpenTelemetry documentation.

In the service map, use the Group by drop-down menu to group instrumented services that share the same built-in or custom indexed span tag key.

Service groups enable you to create conceptual groupings of related services. Use service groups to monitor, aggregate, and compare the performance of services that share an indexed span tag key.

For example, you can create a checkout-related service group to monitor the performance of checkout-related services and understand how they affect each other. The service group can help you understand relationships and dependencies between services, such as whether downstream service groups affect upstream service groups.

On the service group view, each circle represents a service group and displays the number of services in the group. The N/A group includes inferred services and instrumented services that do not have the specified indexed span tag key. If a group is not selected, the panel on the right displays the top 5 highest request, error, and latency (RED) metric values reported by service groups.

The following table describes the actions that you can perform on the service group view.


Action	Result
Select a service group once.	Update the panel on the right to display the aggregated requests and errors for all of the services in the group and a list of the services in the group. In the panel, select a service name to navigate to its service view.
Select a service group twice.	View the services in the group individually on the service map view. The indexed span tag key/value pair is applied as a filter to the service map. Note: If an N/A service group does not have any inferred or instrumented services that share an indexed span tag key, selecting the service group twice will redirect you to the ungrouped service map view without a filter applied.
Add a filter.	Ungroup the services and filter the service map view. To filter the service group view, add your filter(s) to the service map before you group services. Filtering the service group view may reduce the number of groups shown in the service map.

To share your view of the service map with a colleague, copy and share the URL. Your current filter selections are preserved in the URL.

Service map thresholds and limits

The following table presents applicable thresholds and limits in the service map:


Description	Threshold value
Error rate in risk zone, displayed in yellow	5%
Error rate in critical zone, displayed in red	20%
P90 latency in critical zone, displayed in red	1 second
Default maximum number of nodes visible in the service map. Use the filter menu on the map to change the maximum number of services to show.	50 service nodes
Maximum number of nodes visible in the service map at once	200 service nodes
Character limit for service and operation names	1024 characters