Splunk Observability Mobile Rum Setup

Splunk Observability Mobile RUM

Prerequisites

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• Instrumenting mobile apps with Splunk RUM, preparing Mobile Session Replay, preparing mobile-side Digital Experience Analytics (DXA), validating RUM-to-APM linking, or rendering mobile source patches. Do not use for AppDynamics EUM or.
• Preview and review the splunk observability mobile rum setup workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-observability-mobile-rum-setup/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-observability-mobile-rum-setup/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

This skill configures Splunk Observability Cloud Mobile RUM, separate from Kubernetes Browser RUM injection and AppDynamics EUM. It is render-first: snippets and runbooks are the default output; patch files are optional; app source is changed only when --apply-patches --accept-mobile-rum-source-edit is explicitly used. Use it as the mobile instrumentation handoff when a Digital Experience Analytics (DXA) request needs supported iOS or Android RUM agents, user tracking, readable stack traces, or Mobile Session Replay.

Scope

• Native iOS and iPadOS 15+ with the Splunk iOS agent.
• Native Android with Maven Central dependencies, API 24+ default runtime, desugaring, network/crash/ANR/slow-rendering/interaction/lifecycle modules, mapping upload, and WebView bridge snippets.
• React Native 0.75.0+ and React 18.2.0+ for bare apps and Expo development builds, with native-side dSYM/mapping handoffs.
• Flutter 3.32.0+ and Dart 3.8.0+ with splunk_otel_flutter, native-side dSYM/mapping handoffs, route/manual instrumentation, and WebView handoff.
• Session Replay behind --accept-session-replay-enterprise.
• RUM-to-APM linking validation for Server-Timing: traceparent;desc="00-<32 hex>-<16 hex>-01".

Version Pins

Every default below was verified against its upstream registry on 2026-08-20 and is the current release on that date. No pin is knowingly behind upstream.

Flutter agent and Flutter Session Replay must stay on the same minor line: 1.2.0 pins both platform interfaces to >=1.2.0 <1.3.0.

Deployment environment attribute rename

iOS 2.4.1 and Android 2.3.2 renamed the deployment environment resource attribute from deployment.environment to deployment.environment.name. Both agents emit only the new key; there is no transitional dual-emit. Dashboards, detectors, and saved searches that filter or group mobile RUM data on the old key go blank as soon as an app ships these pins. While a fleet straddles the rename, accept both keys rather than switching outright.

The Swift and Kotlin configuration property is still named deploymentEnvironment, so rendered initialization snippets are unaffected.

The renderer rejects latest, +, ranges, wildcard, and otherwise unpinned versions unless --allow-latest-version is set.

Workflow

1. Render snippets:

   bash skills/splunk-observability-mobile-rum-setup/scripts/setup.sh \
     --render \
     --spec skills/splunk-observability-mobile-rum-setup/template.example
   

2. Review splunk-observability-mobile-rum-rendered/:

   • runbook.md
   • preflight-report.md
   • platform snippet directories
   • version-lock.json
   • dSYM/mapping upload helpers
   • Browser RUM and backend auto-instrumentation handoff scripts

3. Optionally render source patches:

   bash skills/splunk-observability-mobile-rum-setup/scripts/setup.sh \
     --render-patches \
     --spec mobile-rum.yaml
   

4. Optionally apply source patches after review:

   bash skills/splunk-observability-mobile-rum-setup/scripts/setup.sh \
     --apply-patches \
     --accept-mobile-rum-source-edit \
     --spec mobile-rum.yaml
   

5. Validate static output and optional RUM-to-APM response headers:

   bash skills/splunk-observability-mobile-rum-setup/scripts/validate.sh \
     --output-dir splunk-observability-mobile-rum-rendered \
     --check-server-timing https://api.example.com/health
   

Safety Rules

• Never pass raw tokens with CLI flags. --rum-token, --access-token, --token, --bearer-token, --api-token, --o11y-token, --sf-token, --hec-token, --platform-hec-token, and --api-key are rejected.
• RUM tokens are client-exposed after release, but this skill still refuses to commit or render raw token values into tracked source. Use token references, build-time config, CI secrets, or mobile platform secret delivery.
• Server-to-server dSYM and Android mapping upload helpers use SPLUNK_O11Y_TOKEN_FILE; they do not accept token literals.
• source_mode: apply-patches requires --accept-mobile-rum-source-edit.
• Session Replay requires --accept-session-replay-enterprise and reviewed masking rules.

References

Read the platform file that matches the app being instrumented:

• references/ios.md
• references/android.md
• references/react-native.md
• references/flutter.md
• references/privacy-session-replay.md
• references/apm-linking.md

Hand-offs

• Browser RUM inside WebViews: splunk-observability-k8s-frontend-rum-setup
• Backend response header enablement: splunk-observability-k8s-auto-instrumentation-setup
• Dashboards: splunk-observability-dashboard-builder
• Detectors: splunk-observability-native-ops

Out Of Scope

• AppDynamics EUM, BRUM, MRUM, or AppDynamics Session Replay.
• Kubernetes Browser RUM HTML injection for web frontends.
• Uploading React Native JS bundle source maps as a Mobile RUM artifact. Browser source maps only apply to WebView pages instrumented with Browser RUM.
• Running mobile app builds or live Splunk uploads by default.