Session Metrics

Last published : Oct 14, 2026
Related information
UXM Metrics

Session Detail

uberAgent collects metrics like the session ID, connection state, protocol latency, and foreground application per user session\.

Details

  • Source type: uberAgent:Session:SessionDetail
  • Used in dashboards: Application Usage, Machine Uptime, SBC Sizing and Capacity Planning, Session 0, Session Info: Citrix, Session Info: VMware, User Session Overview, User Sessions, Single Application Performance, Single Machine Performance, Single User Performance, Analyze data over time
  • Enabled through configuration setting: SessionDetail
  • Related configuration settings: n/a
  • Please also review the metric dependencies.

List of Fields in the Raw Agent Data

Field Description Data type Unit Example Platform
SessionID Session ID generated by the OS. Session IDs are reused and cannot be used to uniquely identify a session. Use SessionGUID for that purpose instead. Number 3 all
SessionLogonTime Time when the user logged on. String 2018-07-23 10:06:02.123 +0200 all
SessionProtocol Remoting protocol used to connect to the session., Possible values on Windows: Console, ICA, RDP, PCoIP, Blast, Frame, Protocol [ID]., Possible values on macOS: Console, RFB, SSH, Protocol [ID]. String ICA all
SessionConnectionState Session connection state. Possible values: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down, initializing, unknown, Unsupported state: [ID]. String active Win
SessionProcessCount Number of processes that are running in the session. Number 34 all
SessionCPUTimeMs CPU usage (absolute usage in milliseconds) of all processes in the session combined. Number ms 3000 all
SessionCPUUsagePercent CPU usage (relative usage in percent) of all processes in the session combined. Number % 29 all
SessionIOPS I/O operations per second of all processes in the session combined. Number 500 Win
SessionIOCount I/O operation count of all processes in the session combined. Number 300 Win
SessionIOMB I/O data volume of all processes in the session combined. Number MB 20 all
SessionIOLatencyMs Latency of I/O operations per session of all processes in the session combined. Number ms 300 Win
SessionWorkingSetMB RAM usage (working set) of all processes in the session combined. Number MB 450.2 all
SessionNetKBPS Process network traffic data volume per second of all processes in the session combined. Number KB 21 Win
SessionUser User name. String Domain\JohnDoe all
SessionGUID Unique identifier for a session that is generated by uberAgent. String 00000002-f295-9109-e7c7-c964011dd401 all
SessionRpLatencyMs2 Remoting protocol latency. This field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent uses the perfmon counter Latency - Last Recorded as the source. This metric is different from Citrix Round-Trip-Time Number ms 30 Win
SessionClientMac Remote client MAC address. Only collected for VMware sessions. String AC-ED-5C-02-F0-30 Win
SessionClientIp Remote client IP address. String 192.168.178.40 all
SessionClientName Remote client name. String Client1 Win
SessionClientDomain Remote client Active Directory domain. String Citrix.com Win
SessionClientUser Remote client user name. String JohnDoe Win
SessionClientUserDomain Remote client user Active Directory domain. String Domain Win
SessionHRes Horizontal resolution. String 1920 Win
SessionVRes Vertical resolution. String 1080 Win
SessionColorDepth Color depth. String 32 Win
SessionClientPlatform Remote client platform. String Windows Win
SessionClientVersion Remote client version. String 13.0.0.256735 Win
SessionClientOsLanguage Remote client operating system language. String en-us Win
SessionPublishedName Published resource name. This resource was used to start or connect to the session. String Google Chrome Win
SessionPublishedAppsCtx List of used Citrix published apps in the session. String Word Excel Win
SessionAppStateCtx Citrix application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. String lingering Win
SessionEncryptionCtx Citrix remoting protocol encryption. Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. String SecureICA Win
SessionClientTypeCtx Citrix client type. Possible values: WI, ICA Client. String WI Win
SessionBrokerDnsVmw VMware broker DNS name. String HorizonCS.Citrix.com Win
SessionBrokerUrlVmw VMware broker URL. String https://192.168.8.6:443 Win
SessionBrokerTunneledVmw VMware: indicates if session is tunneled. Possible values: true, false. String true Win
SessionBrokerTunnelUrlVmw VMware: URL of the View Connection Server tunnel connection. String https://HorizonCS.Citrix.com:443 Win
SessionBrokerRemoteIpVmw VMware broker remote IP address. String 192.168.178.40 Win
SessionBrokerUserVmw VMware broker user name. String John Win
SessionBrokerDomainVmw VMware broker user domain name. String Doe Win
SessionClientTimezoneVmw VMware client timezone. String Europe/Italy Win
SessionClientIdVmw VMware client ID. String c47c60cf41ec44829ff91e1822b24dd8 Win
SessionTypeVmw VMware session type. Possible values: application, desktop. String application Win
SessionBrokerType Remoting broker type. Possible values: Citrix, Microsoft, VMware, Nutanix Frame, none, unknown, Unsupported broker: [number]. String Citrix Win
SessionFgAppId Foreground application ID. Used by uberAgent to look up application names and populate the field SessionFgAppName. String GglChrm all
SessionFgAppVersion Foreground application version. String 67.0.3396.99 all
SessionFgProcessName Foreground process name. String chrome.exe all
SessionFgProcessId Foreground process ID. Number 456 all
SessionFgBrowserType If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4, 5. Also see the field SessionFgBrowserDisplayName. Number 1 all
SessionFgBrowserActiveTabHost If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. String uberagent.com all
SessionFgWindowTitle The title of the active foreground window. String Search | Splunk 7.2.1 - Google Chrome all
SessionClientHwIdCtx2 Citrix client hardware ID. Number 409D39C2 Win
SessionRoundTripTimeMs Citrix session round trip time. Number ms 50 Win
SessionFps Remoting protocol frames per second at collection time. Only available for Citrix and Nutanix Frame sessions. Number 20 Win
SessionTransportProtocols The protocol chain used for this connection. Only available for Citrix sessions. String UDP-CGP-ICA Win
SessionInputDelayMaxMs Maximum input delay per timer interval and session. Number ms 15 all
SessionInputDelaySumMs Sum of input delay per timer interval and session. Number ms 500 all
SessionInputDelayCount PerfMon event count per timer interval and session. Number 50 all

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Application name. Source is the field SessionFgAppId. String Google Chrome Splunk data model, Splunk SPL
SessionCPUTimeS Session CPU usage (absolute usage in seconds). Number s 3 Splunk data model
SessionIODurationMs SessionIOLatencyMs x SessionIOCount. Number ms 90000 Splunk data model
SessionRAMUsagePercent Percentage of the machine's RAM used by the session. Number % 34 Splunk data model
User Alias for SessionUser. String Domain\JohnDoe Splunk data model
SessionUserLower User name converted to lower case. String domain\johndoe Splunk data model
SessionDisplaySpecs SessionHRes + "x" + SessionVRes + "x" + SessionColorDepth. String 1920x1080x32 Splunk data model
SessionPublishedAppsCtxSplit SessionPublishedAppsCtx split by semicolon. String Word;Excel Splunk data model
SessionPublishedAppsCtxSplitLower SessionPublishedAppsCtxSplit converted to lower case. String word;excel Splunk data model
SessionFgAppName Foreground application name. String Google Chrome Splunk data model, Splunk SPL
SessionFgBrowserDisplayName Foreground browser name. Possible values: Chrome, Internet Explorer, Firefox, Edge, Citrix Enterprise Browser. String Chrome Splunk data model, Splunk SPL
SessionClientHwIdCtx SessionClientHwIdCtx2 or SessionClientHwIdCtx, whichever is present. Number 409D39C2 Splunk data model