Monitor errors and crashes in Tag Spotlight
Group errors together in Splunk RUM and use the Tag spotlight to understand application crashes and drill into errors to see associated stack traces and error messages.
Errors are aggregated based on the stack trace. The error stack trace contains the error type and error message in the body of the stack trace. The following table outlines the different ways errors are grouped together depending on the situation.
Situation | How errors are grouped together |
|---|---|
Errors have a stack trace | Errors are grouped by the hash ID of the stack trace |
Error groups are generated with a stack trace | Errors are grouped by the hash ID of the message and error type |
Errors don’t have an error message | Errors are grouped by the hash ID of the error type |
The error ID can represent the following:
Hash ID of a stack trace
Hash ID of a message
Hash ID of the error type
About the error ID
Splunk RUM groups errors based on an error ID (labeled ErrorID) that it computes for each error. Its computation is based on a hash of the error's stack trace, the error's message, and the error's type. It computes each error ID only once. The stack trace component of the hash is different depending on whether the stack trace is symbolicated or not. Therefore, the computed error ID, and hence the grouping of errors, is different depending on when you upload source maps:
If you never upload source maps, the error IDs are based on the unreadable stack traces.
If you upload source maps at the time that you update your application with a new version, the error IDs are based on the readable stack traces.
If you upload source maps "on-demand" (in other words, after Splunk RUM has already ingested some errors) through the UI, the error IDs of existing errors are unchanged (still based on unreadable stack traces) but the error IDs, and hence error groupings, of future errors will be different (based on readable stack traces). If you're looking at a large enough time range to include errors ingested before and after you uploaded your source map, you will see that your application's errors are grouped differently, and the Error summary displays a message to alert you to this fact. The message varies depending on the application's platform, but is something like ..older instances of this crash remain in their original groupings, but newer instances are grouped based on the deobfuscation now available.
Learn more
For more examples on how you can use Tag Spotlight, see Scenario: Deepu finds the root cause of an error using Tag Spotlight.
To learn more about monitoring errors in Splunk RUM for browser, see the scenario Identify errors in browser spans.
For examples on working with tags, see Filter your data by tags in Splunk RUM