Splunk Real User Monitoring (RUM)

Real time health monitoring of our web applications

Splunk RUM was really helpful in identifying brute force attacks as we used Splunk query language and were able to identify how many failed login attempts were made from which country and blacklisted those IP's. Since Splunk entirely depends on Splunk query language, if there are no logs or you delete the logs you can't perform analysis, as there is no stream of live data and also it depends on how frequently your data can be indexed.

Very robust and great tool for the analysis of logging activity, threat intelligence and auditing trails. It allows for collecting, aggregating and prioritizing various systems to locate vulnerabilities to help with the improvement of security operations. It has built-in Incident Response and Breach Notification, and network and vendor security features and plenty of dashboards and alerts that are customizable to your business needs.

Splunk RUM even with the integration problems works very well to provide end-user metrics that allow us to identify any problem our customers may be facing with our app, and it has helped us reduce downtime and customer frustration which leads to increased Productivity, for this reason, I recommend this to anyone that's looking for a user monitoring solution for their application.

Splunk Real User Monitoring assists us in segregating issues rapidly across complex dispersed systems. It has good visibility across all the systems. We can easily finds and resolves flaws minimizing the mean time to mend through its intuitive interface. It offers rapid integration especially when you are part of the Splunk environs. It is generally great but has outdated SDKs

Scenarios where Splunk Real User Monitoring is well suited:
- End-to-end debugging of an application deployed to production.
- Artificial intelligence suggestions based on log data.
- Good user interface.

Scenarios where Splunk Real User Monitoring is less appropriate:
- Where storage available is less.
- Where multiple filters need to be applied at the same time.

This product provides us solutions for a need for security operations, automated response, as well as mapping adjusting of security components. It provides us good SIEM fundamental platform. We are also using Splunk for information assurance, system alerting, and compliance aspects of IT area. Its integration with 3rd parties have good benefits for initial phase.

RUM is best suited to monitor the application where performance is the key indicator. It is useful when it comes to getting real-time updates on what the customer is facing while using a web-based application. Also, figure out the issue and capture it in a report to showcase and work on. We are still exploring the features of how Splunk RUM can be leveraged so that the mobile experience can also be stored and related to web applications.

Was easy to setup with our existing splunk install and has great dashboards already built by default that cover most of the metrics we wanted to see. Once it is all configured there isn't much maintenance that's needs to be done and our frontline uses the dashboard to detect any issues.