Learn about MetricSets in Splunk RUM

A MetricSet is a time series of related metrics. MetricSets typically contain only your most important key performance indicators (KPIs). In Splunk RUM, there are two types of MetricSets:

• Troubleshooting MetricSets

• Monitoring MetricSets

Troubleshooting MetricSets

Troubleshooting MetricSets (TMS) contain high-cardinality metrics that use a span tag as a dimension. Dimensions let you group and analyze metrics using the distinct values of the span tag. For example, if a Troubleshooting MetricSet uses a span tag named user.id as a dimension, you can group its metrics by each distinct value of user.id. This allows you to analyze performance or issues specific to those user.id values, and to make historical comparisons across spans and workflows.

Splunk RUM indexes several span tags by default, and automatically creates Troubleshooting MetricSets for them. You can't modify or stop this behavior. In addition, you can create custom Troubleshooting MetricSets by indexing additional span tags. All indexed span tags are dimensions of the MetricSet that contains them.

Contents

In Splunk RUM, every Troubleshooting MetricSet contains the following metrics:

• Request rate

• Error rate

• Root cause error rate

• p50, p75, and p99 latency

Precision

The measurement precision of Troubleshooting MetricSets is 10 seconds. Splunk RUM reports quantities from a distribution of metrics for each 10-second reporting window.

Visibility

Troubleshooting MetricSets appear in Tag Spotlight. See Analyze service performance with Tag Spotlight.

Retention

Splunk Observability Cloud retains Troubleshooting MetricSets for the same amount of time as raw traces. By default, the retention period is 8 days.

Monitoring MetricSets

Monitoring MetricSets (MMS) contain endpoint-level and service-level metrics. You can use Monitoring MetricSets to create dashboards, charts, detectors, and alerts, and to monitor your environment in real time.

Contents

In Splunk RUM, every Monitoring MetricSet contains a specific endpoint or an aggregate of all endpoints in a service.

Endpoint-level Monitoring MetricSets reflect the activity of a single endpoint in a service, while service-level Monitoring MetricSets aggregate the activity of all of the endpoints in the service. Monitoring MetricSets are created for spans where the span.kind has a value of SERVER or CONSUMER. Spans might lack a kind value, or have a different kind value, in the following situations:

• The span originates in self-initiating operations or inferred services

• An error in instrumentation occurs

Available default Monitoring MetricSet metrics and dimensions

Monitoring MetricSets are available for the Splunk RUM components listed in the following table. Each Monitoring MetricSet also has a set of dimensions you can use to monitor and alert on service performance. In addition to the following default Monitoring MetricSets, you can create custom Monitoring MetricSets to deep dive on your Monitoring MetricSets.

Metric name	Dimensions	Custom dimension available?
service.request - The requests to endpoints in a service.	sf_environment deployment.environment (only available for histogram MMS) sf_service service.name (only available for histogram MMS) sf_error	Yes
inferred.services - The requests to a service that has not yet been instrumented.	sf_service service.name (only available for histogram MMS) sf_environment deployment.environment (only available for histogram MMS) sf_error sf.kind sf_operation sf_httpMethod	No
spans - The count of spans (a single operation).	sf_environment deployment.environment (only available for histogram MMS) sf_service service.name (only available for histogram MMS) sf_operation sf_kind sf_error sf_httpMethod, where relevant	Yes
traces - The count of traces (collection of spans that represents a transaction).	sf_environment deployment.environment (only available for histogram MMS) sf_service service.name (only available for histogram MMS) sf_operation sf_httpMethod sf_error	No
workflows - Created by default when you create a business transaction.	sf_environment deployment.environment (only available for histogram MMS) sf_workflow sf_error	No

Metric types

Monitoring MetricSets in Splunk RUM are generated as histogram metrics. Histogram metrics represent a distribution of measurements or metrics, with complete percentile data available. Data is distributed into equally sized intervals, allowing you to compute percentiles across multiple services, and aggregate datapoints from multiple metric time series. Histogram metrics provide an advantage over other metric types when calculating percentiles, such as the p99 percentile for a single MTS. See more in Metric types. For histogram MMS, there is a single metric for each component.

Previously, Monitoring MetricSets were classified as either a counter or gauge metric type. The previous Monitoring MetricSets included 6 metrics for each component.

Visibility

Monitoring MetricSets appear in Dashboards, Alerts, and charts.

Task	Documentation
Create charts	Create charts in Splunk Observability Cloud
Create dashboards	Create and customize dashboards
Create an alert	Alert on Splunk RUM data
Monitor services in Splunk RUM dashboards	Splunk RUM dashboards

Retention

Splunk Observability Cloud stores Monitoring MetricSets for 13 months by default.