Browser Web App Performance Issue

I am having an issue with the Web App Performance data coming into Splunk. I have set this up on my own machine and installed the extensions and see WebApp data from my machine coming into Splunk, but when I went to set it up on another person's laptop and tried to use the IE extension, the data is not making it to Splunk. I collected logs from both my workstation and the person in question's laptop (uberAgent.log and uberAgentIEExtension.log) and they both look similar, from UberAgent.log:

2019-12-24 07:59:24.848 -0800,DEBUG,PUGET,LPSE64239$,61496,ComputeResults,Timer #4 <Browser performance> Starting data retrieval...
2019-12-24 07:59:24.864 -0800,DEBUG,PUGET,LPSE64239$,61496,BrowserPerformanceIE,Got IE performance data from session(s): 6
2019-12-24 07:59:24.865 -0800,DEBUG,PUGET,LPSE64239$,61496,WebAppPerformance,Got web app performance data from 0 Chrome instance(s) out of 0
2019-12-24 07:59:24.865 -0800,DEBUG,PUGET,LPSE64239$,61496,WebAppPerformance,Got web app performance data from 0 Firefox instance(s) out of 0
2019-12-24 07:59:24.865 -0800,DEBUG,PUGET,LPSE64239$,61496,ComputeResults,Timer #4 <Browser performance> Finished data retrieval.


Then a sample from the uberAgentIEExtension.log:
2019-12-24 08:52:30.334 -0800,DEBUG,PUGET,csieve,88524,ProcessSendData,Successfully read performance data from URL: pse.csod.com
2019-12-24 08:52:33.307 -0800,DEBUG,PUGET,csieve,88696,SendDataThread,Send message: put-webapp-ie "2;2,pse.csod.com,2,pse.csod.com,2,1,200,352.895515,340.185697,12.709333"
2019-12-24 08:58:02.824 -0800,DEBUG,PUGET,csieve,88524,ProcessBeforeNavigate2,Start with URL: https://pse.csod.com/content/PSE/publications/4912/lms/goodbye.html
2019-12-24 08:58:03.223 -0800,DEBUG,PUGET,csieve,88524,ProcessDocumentComplete,Start with URL: https://pse.csod.com/lms/scorm/clientLMS/LMS3.aspx?rNum=1&aicc_sid=1045535pse&packageId=Restricted_Intelligence_-_Season_5,_Episode_6:_Perfect_Storm_ORG&qs=%5e%5e%5eHeJv0O%2b0yAj3W9w756bgNIPO8vX20LiM9HYo17izeBTX4L1g22YQHokjLvoSCGGfzShOXHArzjzJsiYA5epvly%2bCiWn4GurRZuq9V8SCpCIwAiNchcZ7wBPcugTp4GfAPg7EJWv8RwAXm8A%2fwg3MLzlYN9YVuDymYUo9TwZmyMbsRmsoPBzAzflc8w8PF3yMOlSe6Vm9tl2rQb8V0yLsCw%3d%3d - Request URL: https://pse.csod.com/content/PSE/publications/4912/lms/goodbye.html
2019-12-24 08:58:03.234 -0800,DEBUG,PUGET,csieve,88524,ProcessSendData,Successfully read performance data from URL: pse.csod.com
2019-12-24 08:58:05.152 -0800,DEBUG,PUGET,csieve,88696,SendDataThread,Send message: put-webapp-ie "2;2,pse.csod.com,2,pse.csod.com,2,1,200,399.085091,122.096485,276.351030" 

I don't really see any errors coming in from the logs. And when I search in Splunk for sourcetype=uberAgent:Application:BrowserWebRequests2 I am only seeing my own host bring data in. 

I followed the instructions for the manually enabling the IE extension and checked the registry and see the proper value/data fields. 


Any help or suggestions would be great! Thanks

1 comment

  • Avatar
    Timm Brochhaus Official comment


    I'm forwarding this to our support system as we need to look into the log file, which contains sensitive information.

Please sign in to leave a comment.