| SessionID |
Session ID generated by the OS. Session IDs are reused and cannot be used to uniquely identify a session. Use SessionGUID for that purpose instead. |
Number |
|
3 |
all |
| SessionLogonTime |
Time when the user logged on. |
String |
|
2018-07-23 10:06:02.123 +0200 |
all |
| SessionProtocol |
Protocol used to connect to the session. Windows: Console, ICA, RDP, PCoIP, Blast, Frame, Protocol [ID] macOS: Console, ICA, RFB, SSH, Protocol [ID] Linux: Console, ICA, RDP, RFB, SSH, Manager, Protocol [ID] |
String |
|
ICA |
all |
| SessionConnectionState |
Session connection state. Possible values: active, connected, connecting, shadowing,disconnected, idle, listening, reset, down, initializing, unknown, Unsupported state: [ID]. |
String |
|
active |
all |
| SessionProcessCount |
Number of processes that are running in the session. |
Number |
|
34 |
all |
| SessionCPUTimeMs |
CPU usage (absolute usage in milliseconds) of all processes in the session combined. |
Number |
ms |
3000 |
all |
| SessionCPUUsagePercent |
CPU usage (relative usage in percent) of all processes in the session combined. |
Number |
% |
29 |
all |
| SessionIOPS |
I/O operations per second of all processes in the session combined. |
Number |
|
500 |
Win |
| SessionIOCount |
I/O operation count of all processes in the session combined. |
Number |
|
300 |
Win |
| SessionIOMB |
I/O data volume of all processes in the session combined. |
Number |
MB |
20 |
all |
| SessionIOLatencyMs |
Latency of I/O operations per session of all processes in the session combined. |
Number |
ms |
300 |
Win |
| SessionWorkingSetMB |
RAM usage (working set) of all processes in the session combined. |
Number |
MB |
450.2 |
all |
| SessionNetKBPS |
Process network traffic data volume per second of all processes in the session combined. |
Number |
KB |
21 |
Win, Linux |
| SessionUser |
User name. |
String |
|
Domain\JohnDoe |
all |
| SessionGUID |
Unique identifier for a session that is generated by uberAgent. |
String |
|
00000002-f295-9109-e7c7-c964011dd401 |
all |
| SessionRpLatencyMs2 |
Remoting protocol latency. This field is filled with the latency in ms at collection time. If the protocol is ICA, uberAgent on Windows uses the perfmon counter Latency - Last Recorded as the source. This metric is different from Citrix Round-Trip-Time |
Number |
ms |
30 |
all |
| SessionClientMac |
Remote client MAC address. Only collected for VMware sessions. |
String |
|
AC-ED-5C-02-F0-30 |
Win |
| SessionClientIp |
Remote client IP address. |
String |
|
192.168.178.40 |
all |
| SessionClientName |
Remote client name. |
String |
|
Client1 |
all |
| SessionClientDomain |
Remote client Active Directory domain. |
String |
|
citrix.com |
Win |
| SessionClientUser |
Remote client user name. |
String |
|
JohnDoe |
all |
| SessionClientUserDomain |
Remote client user Active Directory domain. |
String |
|
Domain |
Win |
| SessionHRes |
Horizontal resolution. |
String |
|
1920 |
all |
| SessionVRes |
Vertical resolution. |
String |
|
1080 |
all |
| SessionColorDepth |
Color depth. |
String |
|
32 |
all |
| SessionClientPlatform |
Remote client platform. |
String |
|
Windows |
all |
| SessionClientVersion |
Remote client version. |
String |
|
13.0.0.256735 |
all |
| SessionClientOsLanguage |
Remote client operating system language. |
String |
|
en-us |
Win |
| SessionPublishedName |
Published resource name. This resource was used to start or connect to the session. |
String |
|
Google Chrome |
Win |
| SessionPublishedAppsCtx |
List of used Citrix published apps in the session. |
String |
|
Word Excel |
Win |
| SessionAppStateCtx |
Citrix application state. Possible values: n/a, active, pre-launched, lingering, app not running, unsupported. |
String |
|
lingering |
Win |
| SessionEncryptionCtx |
Citrix remoting protocol encryption. Possible values: unknown, basic, logon, 40 bit, 56 bit, 128 bit, SecureICA, unsupported. |
String |
|
SecureICA |
all |
| SessionClientTypeCtx |
Citrix client type. Possible values: WI, ICA Client. |
String |
|
WI |
Win |
| SessionBrokerDnsVmw |
VMware broker DNS name. |
String |
|
HorizonCS.citrix.com |
Win |
| SessionBrokerUrlVmw |
VMware broker URL. |
String |
|
https://192.168.8.6:443 |
Win |
| SessionBrokerTunneledVmw |
VMware: indicates if session is tunneled. Possible values: true, false. |
String |
|
true |
Win |
| SessionBrokerTunnelUrlVmw |
VMware: URL of the View Connection Server tunnel connection. |
String |
|
https://HorizonCS.citrix.com:443 |
Win |
| SessionBrokerRemoteIpVmw |
VMware broker remote IP address. |
String |
|
192.168.178.40 |
Win |
| SessionBrokerUserVmw |
VMware broker user name. |
String |
|
John |
Win |
| SessionBrokerDomainVmw |
VMware broker user domain name. |
String |
|
Doe |
Win |
| SessionClientTimezoneVmw |
VMware client timezone. |
String |
|
Europe/Italy |
Win |
| SessionClientIdVmw |
VMware client ID. |
String |
|
c47c60cf41ec44829ff91e1822b24dd8 |
Win |
| SessionTypeVmw |
VMware session type. Possible values: application, desktop. |
String |
|
application |
Win |
| SessionBrokerType |
Remoting broker type. Possible values: Citrix, Microsoft, VMware, Nutanix Frame, none, unknown, Unsupported broker: [number]. |
String |
|
Citrix |
all |
| SessionFgAppId |
Foreground application ID. Used by uberAgent to look up application names and populate the field SessionFgAppName. |
String |
|
GglChrm |
Win, macOS |
| SessionFgAppVersion |
Foreground application version. |
String |
|
67.0.3396.99 |
Win, macOS |
| SessionFgProcessName |
Foreground process name. |
String |
|
chrome.exe |
Win, macOS |
| SessionFgProcessId |
Foreground process ID. |
Number |
|
456 |
Win, macOS |
| SessionFgBrowserType |
If the foreground window is a browser: browser type. Possible values: 1, 2, 3, 4, 5. Also see the field SessionFgBrowserDisplayName. |
Number |
|
1 |
Win, macOS |
| SessionFgBrowserActiveTabHost |
If the foreground window is a browser: the URL of active tab. See this KB article for troubleshooting empty values. |
String |
|
uberagent.com |
Win, macOS |
| SessionFgWindowTitle |
The title of the active foreground window. |
String |
|
Search Splunk 7.2.1 - Google Chrome |
Win, macOS |
| SessionClientHwIdCtx2 |
Citrix client hardware ID. |
Number |
|
409D39C2 |
all |
| SessionRoundTripTimeMs |
Citrix session round trip time. |
Number |
ms |
50 |
all |
| SessionFps |
Remoting protocol frames per second at collection time. Only available for Citrix and Nutanix Frame sessions. |
Number |
|
20 |
Win |
| SessionTransportProtocols |
The protocol chain used for this connection. Only available for Citrix sessions. |
String |
|
UDP-CGP-ICA |
all |
| SessionInputDelayMaxMs |
Maximum input delay per timer interval and session. |
Number |
ms |
15 |
Win |
| SessionInputDelaySumMs |
Sum of input delay per timer interval and session. |
Number |
ms |
500 |
Win |
| SessionInputDelayCount |
PerfMon event count per timer interval and session. |
Number |
|
50 |
Win |
| SessionFgProcessGuid |
Foreground process GUID. |
String |
|
00000002-f295-9109-e7c7-c964011dd401 |
Win, macOS |
| CtxSessionKey |
The Citrix session key. |
String |
|
1367ba9d-eb01-46ca-9f41-004b2fe1b1db |
Win |
| CtxAutoClientReconnectCount |
The Citrix session reconnect count. |
Number |
|
1 |
Win |
| CtxFrameRateInputFPS |
The frame rate of the operating system / application. |
Number |
|
0 |
Win |
| CtxFrameRateTargetFPS |
The rendering target. |
Number |
|
30 |
Win |
| CtxEDTNAKPacketsSent |
The Citrix EDT NAK packets sent. |
Number |
|
0 |
Win |
| CtxOutOfOrderEDTPackets |
The Citrix out-of-order EDT packets sent. |
Number |
|
0 |
Win |
| CtxHDXDirectStatus |
The Citrix HDX direct status. Possible values: 0, 1 2 |
Number |
|
1 |
Win |
| CtxHDXDirectStatusDisplayName |
The Citrix HDX direct status display name. Possible values: None, Connected-Internal, Connected-External |
String |
|
Connected-Internal |
Win |
