Example of how to predict end-user experience?

[sloshburch]

Does anyone have examples of how to use Splunk to predict end-user experience?

[sloshburch · Accepted solution]

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application developers can leverage data from end-user monitoring scripts, Real User Monitoring (RUM) tools such as Boomerang, and use the Splunk platform machine learning capabilities to predict future web page performance and detect early warning indicators of degrading performance. RUM tools measure the performance characteristics of real-world page loads and interactions. These performance measurements are critically important for managing the customer experience of any web application. Always comply with data privacy rules when working with any end-user monitoring scripts.

Load data

How to implement: This example use case depends on application usage data.

1. Set up the HTTP Event Collector (HEC) to enable token-based data collection using a specific format. For instructions, see Set up and use HTTP Event Collector in Splunk Web in the Getting Data In manual.
2. Set up Cross-Origin Resource Sharing (CORS) HTTP requests to enable your web apps to communicate with directly with the Splunk platform. For instructions, see Communicate with the Splunk server for apps outside of Splunk Web on the Splunk Developer Portal.
3. Implement Boomerang.js in your web pages with the HEC token using these settings:
4. beacon_url to http://<splunk_server>:<HECport>/services/collector/raw?channel=<XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX>, where <splunk_server>:<HECport> is the URL:port for your Splunk HEC receiver endpoint, and <XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX> is the HEC token you created
5. beacon_auth_token to Splunk XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX is the HEC token you created
6. beacon_type to POST

You can enrich the data capture using the BOOMR.addVar method. For example BOOMR.addVar({ "ua_raw": navigator.userAgent}); to add the client's browser type. Boomerang.js is outside the scope of this post, but you can find more information at Boomerang on the Akamai website.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Get insights

Predict the future end-user experience of your web applications based on actual page load time from the end-user's browser.

Run the following search.

index=* t_page=*

 | eval page_load_time=t_page/1000

 | timechart avg(page_load_time) AS "Page Load Time"

 | predict future_timespan=30 "Page Load Time"

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.