Splunk O11y RUM - XHR span not exported when iframe is removed after request completes

Applicability

Description

In Splunk RUM, using @splunk/otel-web 3.2.0, an application initialized inside a cross-origin iframe may not export a successful XHR span when the parent page removes the iframe shortly after the request completes and triggers window.pagehide.

For example, a successful payment API request can start normally but not appear in the RUM session timeline or dashboards if the iframe is destroyed before RUM completes asynchronous processing and exports the network span.

Investigation

Splunk RUM processes network instrumentation asynchronously.

Although an XHR request has received its HTTP response, RUM can still be collecting timing data and completing the associated network span. RUM can export only spans that have ended.

When the parent page removes the iframe:

• The iframe receives pagehide.
• RUM attempts to send available telemetry before the page closes.
• Any network span still being processed has not ended yet.
• The iframe is destroyed before the span can complete and export.

This is expected behavior and is not classified as a product defect. A live page can continuously create new spans, so RUM does not provide a supported API to wait until all span processing has completed.

Resolution

Keep the iframe active for a short period after the XHR response completes and before the parent page removes the iframe.

1. After the application receives the successful XHR response, wait before sending the message that causes the parent page to remove the iframe.
2. Start with a delay of approximately 300 milliseconds if testing shows it is reliable for your application.
3. Test the flow repeatedly in the browsers and environments used by your users.
4. If the span is still missing, increase the delay. A longer delay, such as 2 seconds, provides more time for RUM to finish processing and export the span.
5. Remove the iframe only after the selected delay completes.

Example flow:

XHR response received
      ↓
Wait briefly (for example, 300 ms)
      ↓
Notify parent page
      ↓
Parent removes iframe

Do not rely on a manual flush or a “ready” check. Splunk RUM does not provide a supported public API to confirm that all in-progress spans have finished processing.

Additional information

• The delay required can vary by browser, application behavior, network conditions, and the time needed to collect resource timing information.
• Hiding an iframe without removing it can also keep the RUM context active. However, delaying iframe removal is usually simpler when the application flow permits it.
• Review the Splunk documentation for browser RUM instrumentation-specific data, including XHR and fetch instrumentation behavior.
• Validate the selected delay using multiple successful transactions before deploying the change broadly.