Session Metrics

Session Detail

uberAgent collects metrics like session ID, connection state, protocol latency and foreground application per user session.


  • Source type: uberAgent:Session:SessionDetail
  • Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
  • Enabled through configuration setting: SessionDetail
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionID Unique identifier that is generated by the machine when the session is created.
Will be reassigned to other sessions after logoff.
Number 3
SessionLogonTime Time when the user logged on String 2018-07-23 10:06:02
SessionProtocol Used protocol. Possible values: Console, ICA, RDP, PCoIP, Blast, Protocol [ID] String ICA
SessionConnectionState Connection state. Possible values are: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down,
initializing, unknown, Unsupported state: [ID]
String active
SessionProcessCount Process count Number 34
SessionCPUTimeMs Consumed CPU time Number ms 3000
SessionCPUUsagePercent CPU usage Number % 29
SessionIOPS I/O operations per second Number 500
SessionIOCount I/O operations count Number 300
SessionIOMB I/O operations data volume Number MB 20
SessionIOLatencyMs I/O operations latency Number ms 300
SessionWorkingSetMB Physical RAM allocation Number MB 450.2
SessionNetKBPS Generated network traffic Number KB 21
SessionUser User name String DomainJohnDoe
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
SessionRpLatencyMs Represents the latency of remoting protocols of a user’s session. Field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency – Last Recorded as the source.
This metrik is different from Citrix Round-Trip-Time. More information.
Number ms 300
SessionClientMac Client MAC address String AC-ED-5C-02-F0-30
SessionClientIp Client IP address String
SessionClientName Client name String Client1
SessionClientDomain Client Active Directory domain String
SessionClientUser Client user name String JohnDoe
SessionClientUserDomain Client user Active Directory domain String Domain
SessionHRes Horizontal resolution String 1920
SessionVRes Vertical resolution String 1080
SessionColorDepth Color depth String 32
SessionClientPlatform Client platform String Windows
SessionClientVersion Client version String
SessionClientOsLanguage Client operating system language String en-us
SessionPublishedName Published resource’s name. This resource was used to initiate the session. String Google Chrome
SessionPublishedAppsCtx List of used Citrix published apps in one session String Word
SessionAppStateCtx Application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. Citrix only. String lingering
SessionEncryptionCtx Used encryption.Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. Citrix only. String SecureICA
SessionClientTypeCtx Client type. Possible values: WI, ICA Client. Citrix only. String WI
SessionBrokerDnsVmw Broker DNS name. VMware only. String
SessionBrokerUrlVmw Broker URL. VMware only. String
SessionBrokerTunneledVmw Indicates if session is tunneled. Possible values: true, false. VMware only. String true
SessionBrokerTunnelUrlVmw The URL of the View Connection Server tunnel connection. VMware only. String
SessionBrokerRemoteIpVmw Client IP address. VMware only. String
SessionBrokerUserVmw User name. VMware only. String John
SessionBrokerDomainVmw User domain name. VMware only. String Doe
SessionClientTimezoneVmw Client timezone. VMware only. String Europe/Italy
SessionClientIdVmw Client ID. VMware only. String c47c60cf41ec44829ff91e1822b24dd8
SessionTypeVmw Session type. Possible values: application, desktop. VMware only. String application
SessionBrokerType Broker type. Possible values: Citrix, Microsoft, VMware, none, unknown, Unsupported broker: [1] String Citrix
SessionFgAppId Foreground application ID. Used by uberAgent to lookup application names and populate field SessionFgAppName. String GglChrm
SessionFgAppVersion Foreground application version String 67.0.3396.99
SessionFgProcessName Foreground process name String chrome.exe
SessionFgProcessId Foreground process ID Number 456
SessionClientHwIdCtx Client hardware ID. Citrix only. Number 409D39C2
SessionFgBrowserType Foreground browser. Possible values: 0, 1, 2 Number 1
SessionFgBrowserActiveTabHost The URL used in the foreground browser’s active tab String
SessionFgWindowTitle The title of the active foreground window String Search | Splunk 7.2.1 – Google Chrome

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Application name. Source is the field SessionFgAppName. String Google Chrome Splunk data model, Splunk SPL
SessionCPUTimeS Consumed CPU time Number s 3 Splunk data model
SessionIODurationMs I/O operations duration Number ms 90000 Splunk data model
SessionRAMUsagePercent RAM usage Number % 34 Splunk data model
User User name String DomainJohnDoe Splunk data model
SessionUserExpanded User name String DomainJohnDoe Splunk SPL
SessionUserLower User name converted to lower case String domainjohndoe Splunk data model
SessionDisplaySpecs SessionHRes + “x” + SessionVRes + “x” + SessionColorDepth String 1920x1080x32 Splunk data model
SessionPublishedAppsCtxSplit List of used Citrix published apps in one session split by semicolon String Word;Excel Splunk data model
SessionPublishedAppsCtxSplitLower List of used Citrix published apps in one session split by semicolon converted to lower case String word;excel Splunk data model
SessionFgAppName Foreground application name String Google Chrome Splunk data model, Splunk SPL
SessionFgBrowserDisplayName Foreground browser name. Possible values: Unknown, Chrome, Internet Explorer String Chrome Splunk data model, Splunk SPL

Session Count

uberAgent collects the total session count.


  • Source type: uberAgent:Session:SessionCount
  • Used in dashboards: n/a
  • Enabled through configuration setting: SessionCount
  • Related configuration settings: n/a

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
SessionCount Session count Number 10