How can I fetch Splunk RUM session/span data via API from another service?

[Ahmed_Shakeel]

Hi all,

I've integrated Splunk RUM into one of my web apps using the browser SDK, and data is flowing through correctly and I can see sessions, page views, and spans in the Splunk Observability Cloud RUM dashboards (Session Inspector, Tag Spotlight, etc.).

What I'd like to do now is pull this same data into a separate internal service of mine for further analysis (not just view it in the UI). Specifically, given a splunk.rumSessionId, I want to programmatically retrieve all the spans associated with that session.

What I've tried so far:

1. SignalFlow: (/v2/signalflow/execute) on rum.page_view.count split by splunk.rumSessionId works great for enumerating session IDs, but only gives me aggregated metric data, not the underlying spans.
2. APM trace search: I tried POST /v2/apm/trace/search with a tagFilters body filtering by splunk.rumSessionId, but that endpoint returns 404. From the API reference at dev.splunk.com I can see GET /v2/apm/trace/{traceId} is documented, but there doesn't appear to be a documented way to find the trace IDs belonging to a RUM session in the first place.
3. I noticed the Trace Analyzer feature in the UI clearly does this kind of tag-based lookup, but it doesn't seem to be exposed as a public REST API.

My questions:

1. Is there a supported API to search for traces/spans by tag (e.g. splunk.rumSessionId) in Splunk Observability Cloud?
2. If not, is there a recommended pattern for getting raw RUM span data out of Splunk for downstream processing, for example, an export mechanism, an OTel collector tap before data hits Splunk, or something else?
3. Is the Session Inspector data accessible via any public endpoint, or is it strictly UI-only today?

Realm: us1. Happy to share more detail on the use case if helpful.

Thanks!

[bishida]

Hi,

You are correct that there isn't currently a way to download RUM sessions the same way you can download an APM trace. 

One possible path for you would be to collect RUM with an OTel collector and export the spans to your own system for further analysis. I haven't tried this yet personally, but with the added support for OTLP, there should be a viable way to make it work.

https://help.splunk.com/en/splunk-observability-cloud/manage-data/instrument-front-end-applications/...