icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Web Performance
SHA256 checksum (web-performance_051.tgz) a29b9f7f0fb61843782531b94eb743fdcbf265d91f48dfeb4fa507c6977744cb SHA256 checksum (web-performance_05.tgz) 2d417e36684cb1c07a53e626cc859f158de2b26c48876d71b78940f507d8db9e SHA256 checksum (web-performance_02.tgz) f1525c311176f90e123448a4b6e0cfb10f8a9c95d07d558ccdc1dcaaead51c27
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Web Performance

This app measures the performance of websites using JavaScript (boomerang.js) to beacon Navigation Timing metrics, including DNS Lookup, Start Render, Doc Ready, and Total Page Load Times, to Splunk via Node.js. This monitoring method, known as Real User Monitoring or RUM, collects performance data from real users in real-time. And unlike synthetic monitoring tools (Gomez/Keynote), can provide valuable insights into how well your website or application is performing under real-world condition. Visit the Help section of this app to learn how to get RUM data into Splunk.

Web Performance App Setup

This App uses Node.js to collect web performance data (Web Timing metrics) beaconed from real end users using boomerang.js (a client-side JavaScript library developed by Yahoo!). The data sent by Boomerang to Node is written to /var/log/rum.log by default.

Download & install Node.js. See: http://nodejs.org/download/

Test your Node installation.

node $SPLUNK_HOME/etc/apps/webperf/bin/node/test.js
Server running at

Hit in your browser. Open ports as necessary.

Start the Node server to receive and log performance data from boomerang.js

sudo node $SPLUNK_HOME/etc/apps/webperf/bin/node/server.js
Server running at

Note: You must run server.js as root or someone with privledges to write to /var/log/

Add boomerang.js to the pages you'd like to monitor:

  beacon_url: 'http://node.mydomain.com:7000',
  site_domain: "example.com", 
  user_ip: "{Client IP Address",
  BW: { enabled: true,
    base_url: "http://base_url/to/bandwidth/images/",

See: $SPLUNK_HOME/etc/apps/webperf/examples/example.html for a working example (View Soruce)

That's it! Data sent by boomerang.js should now be flowing into Splunk. Tail /var/log/rum.log to verify that you are receiving data.

Generating Sample Data:

To generate fake sample data, similar to that beaconed back by boomarang (that's a mouth full), use the data_gen.js node script.

node $SPLUNK_HOME/etc/apps/webperf/bin/node/data_gen.js
Note: This will create ~1 event/second for example.com until it reaches 1,000 events.

Boomerang Beacon Parameters:

The beacon that sent to your server will contain several parameters. Each boomerang plugin also adds its own set of parameters.

Default boomerang parameters

  • v : Version number of the boomerang library in use.
  • u : URL of page that sends the beacon.

Roundtrip plugin parameters

  • t_done [optional] Perceived load time of the page.
  • t_page [optional] Time taken from the head of the page to page_ready.
  • t_resp [optional] Time taken from the user initiating the request to the first byte of the response.
  • t_other [optional] Comma separated list of additional timers set by page developer. Each timer is of the format name|value. The following timers may be included:
  • t_load [optional] If the page were prerendered, this is the time to fetch and prerender the page.
  • t_prerender : [optional] If the page were prerendered, this is the time from start of prefetch to the actual page display. It may only be useful for debugging.
  • t_postrender [optional] If the page were prerendered, this is the time from prerender finish to actual page display. It may only be useful for debugging.
  • boomerang = The time it took boomerang to load up from first byte to last byte
  • boomr_fb [optional The time it took from the start of page load to the first byte of boomerang. Only included if we know when page load started.
  • r URL of page that set the start time of the beacon.
  • r2 = [optional] URL of referrer of current page. Only set if different from r and strict_referrer has been explicitly turned off.
  • rt.start = Specifies where the start time came from. May be one of cookie for the start cookie, navigation for the W3C navigation timing API, csi for older versions of Chrome or gtb for the Google Toolbar.
  • rt.bstart = The timestamp when boomerang showed up on the page
  • rt.end = The timestamp when the done() method was called

Bandwidth & latency plugin

  • bw = User's measured bandwidth in bytes per second
  • bw_err = 95% confidence interval margin of error in measuring user's bandwidth
  • lat = User's measured HTTP latency in milliseconds
  • lat_err = 95% confidence interval margin of error in measuring user's latency
  • bw_time = Timestamp (seconds since the epoch) on the user's browser when the bandwidth and latency was measured

Source: http://lognormal.github.io/boomerang/

Example Beacon:

Below is an example of the beaconed paramaters with the bandwidth & latency and navigation timing plugins enabled converted to JSON.

  "ua_raw":{"string":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36",

Source: https://github.com/codycharris/splunk_web_performance

Release Notes

Version 0.5.1
Nov. 26, 2013

Fixed server.js and help documentation.

Version 0.5
Nov. 25, 2013

Updated for Splunk 6. New interactive dashboards.

Version 0.2
Nov. 25, 2013


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.