topic Re: Does Splunk have any ability to "pull" data? in Getting Data In

Does Splunk have any ability to "pull" data?

larryleeroberts — Thu, 16 Jan 2020 14:58:06 GMT

We use Splunk onprem and we also have Dynatrace SaaS. Dynatrace recently release the ability to access the audit logs via their API. I would really like to get these logs into Splunk. I am trying to figure out of there is anything within Splunk that provides the ability to "pull" these logs.

Has anyone accomplished this?

Re: Does Splunk have any ability to "pull" data?

mydog8it — Thu, 16 Jan 2020 15:10:40 GMT

The Dynatrace app for Splunk collects via the Dynatrace API:
https://splunkbase.splunk.com/app/4040/

Re: Does Splunk have any ability to "pull" data?

kamlesh_vaghela — Thu, 16 Jan 2020 15:13:42 GMT

@larryleeroberts
Have you tried these apps ?

Dynatrace Add-on for Splunk (https://splunkbase.splunk.com/app/3969/)
Dynatrace App for Splunk (https://splunkbase.splunk.com/app/4040/)

Re: Does Splunk have any ability to "pull" data?

larryleeroberts — Thu, 16 Jan 2020 15:24:22 GMT

I knew it collected metrics, but not the logs. I will give it a try - Thank you! Very much appreciated.

Re: Does Splunk have any ability to "pull" data?

larryleeroberts — Thu, 16 Jan 2020 20:14:00 GMT

FYI... Kinda what I thought. These apps can't read the new audit logs. No option for that with the current version.

Re: Does Splunk have any ability to "pull" data?

spostma — Thu, 16 Jan 2020 21:39:14 GMT

i am using the Splunk REST API App (paid) https://splunkbase.splunk.com/app/1546/
there your able to write your own rest API call and import it into splunk.

Re: Does Splunk have any ability to "pull" data?

larryleeroberts — Thu, 16 Jan 2020 21:52:31 GMT

Thanks! I decided to just use the Splunk Add-On Builder to make my own app to do it. We will see how that goes.