Monitor applications in Splunk APM

Group services as applications to monitor the health, performance, and dependencies of services that support specific business capabilities.

In Splunk APM, applications are groups of services that share the same indexed span tag key. You can group services as applications to monitor the health, performance, and dependencies of services that support specific business capabilities.

For example, you can create a checkout-related application to monitor the performance of checkout-related services and understand how they affect each other. The application can help you understand relationships and dependencies between services, such as whether downstream applications affect upstream applications.

Prerequisites

To group services as applications, you must have the admin role in Splunk Observability Cloud and complete the following steps.

  1. Add context to spans with span tags in Splunk APM.

  2. Index span tags to create Troubleshooting MetricSets.

  3. Group services by the indexed span tag in Splunk APM:

    1. From the Splunk Observability Cloud main menu, select Settings > APM services & traces.

    2. Select the Applications tab.

    3. Enable the Group applications based on APM indexed tag toggle.

    4. Select an indexed span tag. All services with the indexed span tag key will be grouped as an application.

Monitor all applications with the Applications tab

For an aggregate monitoring view of all the applications in your environment, use the Splunk Observability Cloud main menu to select APM > Applications & services. Select the Applications tab.

The Applications tab displays a table of applications along with their health status and RED (request count, error count, and duration) metrics. Select the health status in the Health column to view the list of alerts for the application.

The health status of an application is the most critical health status of one of its services. For more information on service health statuses, see Monitor service health in the service map.

Monitor an application with the Application overview

Drill down on a specific application from the APM > Applications & services > Applications tab by selecting the name of the application in the table.

The Application overview includes a service map and a panel with information about the health, performance, and alerts of your application. The following sections describe how to use these components.

Monitor the services and relationships of an application

On the Application overview, you can use the service map to understand the services included in the application and their relationship to each other.

Select a service node from the map to display a panel with the RED metric charts.

To drill down from the panel in the service map without losing application context, select View endpoints or View instances in the panel to navigate to the Endpoints or Instances tabs in the service view with the service filter pre-populated.

To update the service map to show related applications, select the filter drop-down menu and enable the Show related applications toggle. In the map, select an application node twice to navigate to the overview for that application.

Monitor the health, performance, and alerts of an application

On the Application overview, you can monitor the health status, performance, and alerts of an application with the panel on the right side of the service map.

The Service health and Business transaction health bars show the proportion and number of services and business transactions that have Warning, Critical, or Not assessed health statuses. To enable or learn more about these health statuses, see Monitor service health in the service map and Monitor business transaction health.

The RED metric charts list the top 5 services for each metric.

The Latest alerts table shows all critical and warning alerts for the services included in the application. The icon next to the alert name reflects the alert severity. You can select an alert row to view a panel with more details about the alert, or select a Service name from the table to navigate to the service view.
Note:

To understand the severity mapped to each alert icon, use the Splunk Observability Cloud main menu to select Alerts > Active alerts. Reference the legend above the table.

From the Application overview, you can select the Services, Business transactions, Endpoints, or Instances tab to show the list of related entities and their RED metrics. Services and business transactions also include health status. Select the name of any related entity to monitor the entity in greater detail.

Note:

To monitor instances related to an application, you must complete the prerequisites for the instances(s) you want to monitor.

Select the Instances tab from the Application overview to display a table of the instances related to your application and instance metrics.

When you access this tab from the Application overview, the filters are set to Service type: Any and All Services by default. The table displays the related instances along with the request, error, and duration (RED) metrics for each instance. If the instance is an infrastructure component, the table also displays infrastructure metrics and attributes.

To filter the table to show Java or .NET instances and runtime metrics, set the Service type filter to Java or .NET. You can optionally filter for a specific service with the All <service-type> filter.

Selecting a service type shows the Runtime (<service-type>) tab, which displays the heap and garbage collection metrics for the service instance in the table. You can select the APM & Infrastructure tab to view the RED and infrastructure metrics for the service instance.

In any tab, you can:

  • Select the Instance ID to view the Service instance details panel. This panel includes detailed metric visualizations and data.

  • Select the Service name to navigate to the service view.

Monitor baselines for APM metrics

Use baselines on the Application overview to understand if a metric is behaving normally based on recent history.

A baseline is a dashed comparison line shown for the Requests and P90 metrics in the charts. The baseline is the mean of the metric across multiple time periods.

The following table describes the supported baseline modes.
Baseline mode Description
Daily Understand what this metric typically looks like at this hour, averaged across the last week.
Weekly Understand what this metric typically looks like at this hour, averaged across the last 4 weeks.
Complete the following steps to add a baseline to a metric chart:

  1. From the Splunk Observability Cloud main menu, select APM > Applications & services.

  2. From the Application overview, select the name of the application in the table.

  3. Select the Services or Business Transactions tab.

  4. Select the Baselines drop-down menu and select a baseline mode.

You can use the service map to view the applications that interact with a service. Use this view to understand the dependencies between a service and the applications in your environment.

Complete the following steps to view the related applications for a service.

  1. From the Splunk Observability Cloud main menu, select APM > Service map.

  2. Group services in the service map.

  3. Select an application node twice.

  4. Select the filter drop-down menu.

  5. Enable the Show related applications toggle.