Data Collected

Indexes

The following indexes is used by UXM:

Index name	Type	Description
uxmapp_response	Events	Event data for data containing response metrics.
uxmapp_sessiondata	Events	Event data for data containing large sessiondata, for example Browser timings, Desktop processes, etc.
uxmapp_metrics	Metrics	Metric Store data for faster queries against metric data. See https://www.splunk.com/en_us/resources/videos/splunk-metric-store.html
uxmapp_metrics_rollup	Metrics	Hourly rollup of _metrics for long term reporting.
uxmapp_confidential	Events	Confidential data that only a limited number of people can access and view.
uxmapp_si_hourly	Events	For hourly summary index rollups. (Will be deprecated in future version after migration to Data Models and Metric Store)
uxmapp_si_quarterly	Events	For quarterly summary index rollups. (Will be deprecated in future version after migration to Data Models and Metric Store)

 

UXM Web Agent

Transaction (web.transaction.browser)

Field name	Display name	Example Value	Description
host		FQDN	UXM Web JavaScript agent key which is defined when installing/configuring JavaScript on web server, default is the FQDN where the script runs on.
source		web.transaction.browser
sourcetype		uxm:json	Data is stored as JSON.
timestamp_utc		2019-12-19T10:08:27	UTC Timestamp from when data was received on UXM Collector.
name	Name / Transaction	All Other Pages	Transaction Name, can also be looked up by using key field.
id		8845d3cc-2247-11ea-b293-02c76b322bd4	A unique user identifier generated when parsing data received, used to lookup navigation timings.
country	Country	IE	Country A2 code looked up via ip field in UXM Locations and in MaxMind GeoIP. | lookup ux_countries_lookup a2_country AS country OUTPUT country_name
location	Location	Ireland	Country/Location name looked up via ip field in UXM Locations and in MaxMind GeoIP.
key		5ddd08da15c8d5536f500da4	Transaction key used to lookup transaction name and settings via ux_transactions_lookup
app_key		5d49808415c8d547617bddaf	Application key used to lookup application name and settings via ux_applications_lookup | lookup ux_applications_lookup _key AS app_key OUTPUT name AS applicationNameLookup, enabled
time	Response Time	1.83	Total load time for transaction.
ui	Browser	IE	Browser detected from User-Agent header.
ui_version	Browser Version	11	Browser version detected from User-Agent header.
device	Device Type	Samsung SM-N920S, Nexus 5, Other	Mobile device detected from User-Agent header.
ip	IP	34.6.6.0	Users remote ip detected by the UXM collector, will be internal IP's if data is send to internal UXM collector. Last octet can be set to 0 to comply with GDPR rules.
os	OS	Windows
os_version	OS Version	10
url	Url	https://demo-weatherapp.uxmapp.com/
query	Query	rfr=Admin_o365&exsvurl=1&mkt=en-US
identifier	Identifier	{"event":"click","text":"Login","parent-div-class":"container"}
title	Title	Website Title
session_id	Session ID	8liJT6ZIlLCIXVH2MHx9CGhKF	A unique user identifier generated in the Browser, it's consistant untill user closes the browser.
sla	SLA	0	SLA rating compared to SLA Targets, used to calculate Apdex score. 0=Satisfied, 1=Tolerated, 2=Frustrated
sla1	Tolerated SLA	Default 5	Tolerated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 1 (Tolerated) if time field > sla2 field.
sla2	Frustrated SLA	Default 20	Frustrated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 2 (Frustrated) if time field > sla2 field.
use_sla	Use in SLA report	0	Field used to exclude/include transaction data in SLA and Monthly reports.
timing_count		0	Number of resource timing events detected.
event_count		0
xhr_count		0	Number of XHR calls detected during this transaction.
trace_id	Trace ID	cba9d021613c99b2	Trace ID captured by JavaScript from setting or Timing Header, used to correlate with backend tracing like SignalFX, Instana, etc. uxm_web('trace.id', '180faa8dd6d87384');
username	Username	Username, Email or Firstname Lastname	Optional feature: Custom JavaScript can be added to capture user information from the HTML page. See Web Agent options on how to activate it.

Resource Timings - Document (web.browser.timing.doc)

Field name	Display name	Example Value	Description
host		8845d3cc-2247-11ea-b293-02c76b322bd4	Unique identifier from web.transaction.browser that this timing belongs to. We use the host field because it's indexed by default by Splunk for faster lookups.
source		web.browser.timing.doc
sourcetype		uxm:web:timing:document	Timing data is stored in CSV format separate with | sign to save space in the daily Splunk license. (By not storing field names) Mapping to field names is done via transforms.conf and props.conf
application_key		5d49808415c8d547617bddaf	Application key used to lookup application name and settings via ux_applications_lookup
transaction_key		5ddd08da15c8d5536f500da4	Transaction key used to lookup transaction name and settings via ux_transactions_lookup
location		Ireland	Country/Location name looked up via ip field in UXM Locations and in MaxMind GeoIP.
origin		https://demo-weatherapp.uxmapp.com/	URL that resource was requested from.
name	Url	https://demo-weatherapp.uxmapp.com/	Resource requested.
offset	Start Time	432	Start offset in ms from page load began.
duration	Response Time	321	Time it took to load resource in milliseconds.
redirect	Redirect	1	Navigation Timing is taken directly from browser Performance API.
appcache	App Cache	1	Navigation Timing is taken directly from browser Performance API.
dns	DNS	7	Navigation Timing is taken directly from browser Performance API.
tcp	TCP	5	Navigation Timing is taken directly from browser Performance API.
ssl	SSL	6	Navigation Timing is taken directly from browser Performance API.
request	Request	105	Navigation Timing is taken directly from browser Performance API.
response	Response	298	Navigation Timing is taken directly from browser Performance API.
unload	Unload	7	Navigation Timing is taken directly from browser Performance API.
dom	DOM	772	Navigation Timing is taken directly from browser Performance API.
children	Children	3590	Navigation Timing is taken directly from browser Performance API. Note that this timing can include modal popup's that shows alerts or asks for login credentials.
first_paint	First Paint Time	909	Paint Timings is only available in Chrome 60+ and Opera 47+.
first_contentful_paint	First-Contentful Paint Time	909	Paint Timings is only available in Chrome 60+ and Opera 47+.
correlation_token

UXM Desktop Agent

Transaction (desktop.transaction)

Field name	Display name	Example Value	Description
host		5d05ad82d053082a69343a52	Node transaction occured on, lookup hostname and info via ux_nodes_lookup. | lookup ux_nodes_lookup _key AS host OUTPUT hostname, last_registration, internal_ip, country, memory_mb, cpu_cores, tags, os, enabled
source		desktop.transaction
sourcetype		uxm:json
timestamp_utc		2019-12-19T10:08:27	UTC Timestamp from when transaction started. (Also stored in Splunk _time field)
name	Name	Preview Email	Name of the transaction, defined in XML Desktop profile.
id	ID	8845d3cc-2247-11ea-b293-02c76b322bd4	A unique identifier generated when parsing data received, used to lookup transaction data.
country	Country	IE	Country A2 code looked up via ip field in UXM Locations and in MaxMind GeoIP. | lookup ux_countries_lookup a2_country AS country OUTPUT country_name
location		Ireland	Country/Location name looked up via ip field in UXM Locations and in MaxMind GeoIP.
app_key		5d49808415c8d547617bddaf	Application key, lookup in ux_applications_lookup to get info about application transaction belongs to. | lookup ux_applications_lookup _key AS app_key OUTPUT name AS applicationNameLookup, enabled AS applicationEnabledLookup
node_key		5d05ad82d053082a69343a52	Deprecated: Same as host, will be removed in future versions.
key		5cbef8d6d0530842ea18ea95	Profile key, lookup in ux_profiles_lookup to get info about application transaction belongs to. (Name is already taken out and stored in name field) | lookup ux_profiles_lookup _key AS key OUTPUT name AS profileName
time	Response Time	0.78	Measured time it took for transaction to finish. Defined as from when start rule event began in XML Desktop Profile to Complete rule event occured.
client_ip		156.54.1.32	Client IP is set for RDP or Citrix sessions and shows the IP for the client connecting to the RDP/Citrix server. Last octet can be set to 0 to comply with GDPR rules.
local_ip		10.2.0.23	Local IP on the LAN. Last octet can be set to 0 to comply with GDPR rules.
ip	IP	213.2.1.0	Users remote ip detected by the UXM collector, will be internal IP's if data is send to internal UXM collector. Last octet can be set to 0 to comply with GDPR rules.
failed	Staus	1=Failed, 0=Passed	Is set to 1 if transaction failed or had validation errors. (For example dialog with error message occured, have to be defined in XML Desktop Profile.)
identifier			XML Desktop profile can capture text from MSAA event and send in identifier field. Example: Can be used to capture title of video playing in Windows Media Player.
session_guid	Session GUID
session_id	Session ID	4	Windows Session ID that is assigned to the user.
title
ui		outlook.exe	Executable that transaction belongs to.
ui_path		C:\Program Files (x86)\Microsoft Office\root\Office16\	Path to executable that transaction belongs to. (Added to differentiate between Prod and Test applications if they have the same execuatable name)
ui_version		16.0.12527.20278	Version of the executable that transaction belongs to.
username		Test Username	Username of user logged into Desktop PC.
sla	SLA	0	SLA rating compared to SLA Targets, used to calculate Apdex score. 0=Satisfied, 1=Tolerated, 2=Frustrated
sla1	Tolerated SLA	5	Tolerated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 1 (Tolerated) if time field > sla2 field.
sla2	Frustrated SLA	20	Frustrated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 2 (Frustrated) if time field > sla2 field.
use_sla	Use in SLA report	1	Field used to exclude/include transaction data in SLA and Monthly reports.

Applications installed (agent.programs.installed)

Field name	Display name	Example Value	Description
host		5d05ad82d053082a69343a52	Node application is installed on, lookup hostname and info via ux_nodes_lookup. | lookup ux_nodes_lookup _key AS host OUTPUT hostname, last_registration, internal_ip, country, memory_mb, cpu_cores, tags, os, enabled
source		agent.programs.installed
sourcetype		uxm:json
timestamp_utc		2019-12-19T10:08:27	UTC Timestamp from when data was collected. (Also stored in Splunk _time field)
guid		Google Chrome
install_date		20210203
install_source
install_location		C:\Program Files\Google\Chrome\Application
is_64_bit		0	0 = Installed under Wow6432 1 = Is 64 bit
language		0
major
major_version_parsed
minor
name		Google Chrome
name_parsed		Google Chrome
publisher		Google LLC
version		88.0.4324.146
windows_installer		0

UXM Robot Agent

Test execution (robot.execution)

Field name	Display name	Example Value	Description
host		5d05ad82d053082a69343a52	Node that executed the test, lookup hostname and info via ux_nodes_lookup. | lookup ux_nodes_lookup _key AS host OUTPUT hostname, last_registration, internal_ip, country, memory_mb, cpu_cores, tags, os, enabled
source		robot.execution
sourcetype		uxm:json
timestamp_utc		2019-12-19T10:08:27	UTC Timestamp from when test was started.
name	Script	www.mcg.dk	Name of the test.
id	ID	8845d3cc-2247-11ea-b293-02c76b322bd4	A unique identifier generated when parsing data received, used to lookup transaction data.
country	Country	IE	Country A2 code looked up via ip field in UXM Locations and in MaxMind GeoIP. | lookup ux_countries_lookup a2_country AS country OUTPUT country_name
location		Ireland	Country/Location name looked up via ip field in UXM Locations and in MaxMind GeoIP.
app_key		5d49808415c8d547617bddaf
node_key		5d05ad82d053082a69343a52	Deprecated: Same as host, will be removed in future versions.
script_key		5d49806615c8d547617bddae	Robot script that executed the test, use to lookup name and settings in ux_robot_scripts.
time	Run Time	49.83	Time it took to execute whole test including each transaction step.
executable	UI / Browser / App	IE 11.0	Warning: Might be renamed to align with ui from Web/Desktop and Robot Transaction.
msg	Message	Step: 01 - Frontpage, failed: BrowserVerifyProperty(BrowserEngine: 29 - UI element not found)	Test result message, will contain info about why test failed.
msg_level	Level	error, warning, info	Message Level (error, warning, info)
failed	Staus	1=Failed, 0=Passed	Is set to 1 if test failed or had validation errors.
log		20191219_101624_bb6301de-2248-11ea-8900-02c76b322bd4.log	Name of execution log file, log files are stored on the disk outside of Splunk to save space in the Indexes and Daily License limit.
video		20191219_101624_test_with_validation_failure_VUser-Profile1_1_cleaned.xlg	Name of Visual log file, Visual log files are stored on the disk outside of Splunk to save space in the Indexes and Daily License limit. Can be a Video (LeapWork, Ranorex) or TrueLog file (SilkPerformer)
resolution	Resolution	Unknown or 1024x786	Resolution of display on node that executed the test.

Test transaction (robot.transaction)

Field name	Display name	Example Value	Description
host		5d05ad82d053082a69343a52	Node that executed the test, lookup hostname and info via ux_nodes_lookup. | lookup ux_nodes_lookup _key AS host OUTPUT hostname, last_registration, internal_ip, country, memory_mb, cpu_cores, tags, os, enabled
source		robot.transaction
sourcetype		uxm:json
timestamp_utc		2019-12-19T10:08:27	UTC Timestamp from when test was started.
name	Name	07 - Test Site - Test visual page	Name of the transaction step.
execution_id		8845d3cc-2247-11ea-b293-02c76b322bd4	Points to the unique identifier in robot.execution so execution data can be looked up.
country	Country	IE	Country A2 code looked up via ip field in UXM Locations and in MaxMind GeoIP. | lookup ux_countries_lookup a2_country AS country OUTPUT country_name
location	Location	Ireland	Country/Location name looked up via ip field in UXM Locations and in MaxMind GeoIP.
key		5d4c214e15c8d53382489411	Transaction key used to lookup transaction name and settings via ux_transactions_lookup.
app_key		5d49808415c8d547617bddaf	Application key used to lookup application name and settings via ux_applications_lookup | lookup ux_applications_lookup _key AS app_key OUTPUT name AS applicationNameLookup, enabled
node_key		5d05ad82d053082a69343a52	Deprecated: Same as host, will be removed in future versions.
script_key		5d49806615c8d547617bddae	Robot script that executed the test, use to lookup name and settings in ux_robot_scripts.
sla	SLA	0	SLA rating compared to SLA Targets, used to calculate Apdex score. 0=Satisfied, 1=Tolerated, 2=Frustrated
sla1	Tolerated SLA	5	Tolerated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 1 (Tolerated) if time field > sla2 field.
sla2	Frustrated SLA	20	Frustrated SLA target set for transactions under Administration -> SLAs. SLA field will be set to 2 (Frustrated) if time field > sla2 field.
use_sla	Use in SLA report	1	Field used to exclude/include transaction data in SLA and Monthly reports.
time	Response Time	2.41	Total load time for transaction step.
ui		Chrome 75.0.3770.142	Browser detected from User-Agent header or parsed from test files.
ui_version			Browser version detected from User-Agent header or parsed from test files.
msg			Transaction step result message, will contain info about why test failed.
msg_level		error, warning, info	Message Level (error, warning, info)
failed		1= failed, 0=ok	Is set to 1 if test failed or had validation errors.
after_screenshot		20191219_101624_test_step1_after.png	Name of screenshot from after step was performed (Verification step), files are stored on the disk outside of Splunk to save space in the Indexes and Daily License limit.
before_screenshot		20191219_101624_test_step1_before.png	Name of screenshot from before step was performed, files are stored on the disk outside of Splunk to save space in the Indexes and Daily License limit.