Splunk RUM

What Splunk RUM is and what it does

Splunk Real User Monitoring (RUM) is the browser side observability product of Splunk Observability Cloud, which Cisco acquired from Splunk in 2024 (and which itself grew out of SignalFx and Omnition). A small JavaScript agent based on the OpenTelemetry Web SDK loads on each page and silently measures how the site performs for real visitors. It captures navigation timings, the Core Web Vitals (LCP, INP, CLS), JavaScript errors, AJAX requests, route changes and explicit user actions. These signals are sent as OpenTelemetry spans to a Splunk Observability Cloud ingest endpoint in the chosen realm and can be linked to backend traces from Splunk APM.

Data and cookies collected by Splunk RUM

By default Splunk RUM does not set HTTP cookies. The agent generates a random session ID and stores it in browser session storage under splunk.rumSessionId, so it lives only for the current tab session. Each span typically carries the page URL, referrer, user agent, screen size, language, the truncated client IP, timing metrics, error stack traces and any custom attributes the site operator chooses to add (build version, route, feature flags). Calling setGlobalAttributes with a user ID or email turns the otherwise pseudonymous telemetry into personal data and changes the legal analysis.

GDPR and ePrivacy implications

Splunk RUM processes data about identified or identifiable visitors as soon as IPs are kept in full, a user ID is attached, or interaction data allows singling out a person. The website operator is controller and Cisco (Splunk) is processor, under a data processing addendum signed as part of the Observability Cloud contract. The ePrivacy Directive, transposed into laws such as the German TDDDG and the French LCEN, also applies because the agent reads from and writes to session storage on the user terminal. Whether prior consent is needed depends on whether that storage is strictly necessary for the service the user requested.

Consent requirements and legal basis

A minimal RUM configuration, with truncated IPs, no user identifiers, no marketing related custom attributes and a clear performance and security purpose, can usually be justified on legitimate interest (Art. 6(1)(f) GDPR) and treated as strictly necessary under the ePrivacy regime. As soon as Splunk RUM is enriched with logged in user IDs, custom attributes carrying personal data, session reconstruction or business A/B testing, the processing leaves the strictly necessary scope and consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) becomes the proper basis. CCPA and LGPD additionally require clear notice and an opt out.

Cross border data transfers and practical compliance steps

Splunk Observability Cloud is offered in several realms: US (primary, AWS US regions), EU (Frankfurt), APAC and Japan. The EU realm keeps RUM telemetry within the EEA and removes most third country concerns; other realms imply transfers outside the EEA covered by Standard Contractual Clauses and, for the US, the EU US Data Privacy Framework under which Cisco is certified. Practical steps: pick the EU realm where data residency matters, configure beaconUrl accordingly, enable IP truncation, avoid sending user IDs unless required, document Splunk RUM in your record of processing, list cisco.com and signalfx.com in your privacy notice, gate the agent behind your CMP when used beyond strictly necessary monitoring, and review Cisco DPF and SCCs annually.