Example of how to monitor end-user experience?

[sloshburch]

Does anyone have examples of how to use Splunk to monitor end-user experience?

[sloshburch · Accepted solution]

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application developers can leverage data from end-user monitoring scripts, Real User Monitoring (RUM) tools such as Boomerang, and JavaScript to monitor and manage the end-user experience of your web sites. Gain the ability to analyze not only the performance of your web sites, but also the breakdown of that performance by browser, by page, by user, by DNS lookup or any number of other attributes. These performance measurements are critically important for managing the customer experience of any web application. Always comply with data privacy rules when working with any end-user monitoring scripts.

Load data

How to implement: This example use case depends on RUM data and application usage data.

1. Set up the HTTP Event Collector (HEC) to enable token-based data collection using a specific format. For instructions, see Set up and use HTTP Event Collector in Splunk Web in the Getting Data In manual.
2. Set up Cross-Origin Resource Sharing (CORS) HTTP requests to enable your web apps to communicate with directly with the Splunk platform. For instructions, see Communicate with the Splunk server for apps outside of Splunk Web on the Splunk Developer Portal.
3. Implement Boomerang.js in your web pages with the HEC token using these settings:
4. beacon_url to http://<splunk_server>:<HECport>/services/collector/raw?channel=<XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX>, where <splunk_server>:<HECport> is the URL:port for your Splunk HEC receiver endpoint, and <XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX> is the HEC token you created
5. beacon_auth_token to Splunk XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX is the HEC token you created
6. beacon_type to POST

You can enrich the data capture using the BOOMR.addVar method. For example BOOMR.addVar({ "ua_raw": navigator.userAgent}); to add the client's browser type. Boomerang.js is outside the scope of this post, but you can find more information at Boomerang on the Akamai website.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Get insights

Monitor the end-user experience of your web applications based on actual page load time from the end-user's browser.

Run the following search.

index=* ua_raw=*

 | eval useragent=urldecode(ua_raw) 

 | stats count BY useragent

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.