Example of how to use Dynatrace with the Splunk platform?

[sloshburch]

Does anyone have examples of how to use Splunk to use Dynatrace with the Splunk platform?

[jpcdt]

Good day...as a current Dynatracer who spent a long time working in the Splunk world, I would suggest you look to move away from the Splunk App for Dynatrace based on a few factors:

• The App is not available for Splunk 8
• You deal with troubleshooting issues like these where you're asking questions of an app you need to understand but didn't write.

I recommend using the REST API Modular Input to pull data from the Dynatrace API. You can validate your API calls
and results using something like Postman and then move them over the Modular input rather easily. The REST API Modular input is a long-time and well tested app in the Splunk community which is actively maintained. The only caveat is if you use Splunk Cloud, you will need to use the REST API modular input on a Heavy Forwarder to execute the API calls, and then have it send the data to your proper index on Splunk cloud.

[sloshburch · Accepted solution]

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application support engineers can use the machine learning capabilities of the Splunk platform with their Dynatrace Application Performance Monitoring (APM) data for infrastructure troubleshooting. Use the Splunk platform to trend past performance and predict future application response times, error rates, and end-user experience. Correlate your APM data with the data from load balancers, network and infrastructure components, content delivery networks, cloud providers, and other resources from a single console to reduce the time to resolution for application issues.

Use of Dynatrace is outside the scope of this answer, but you can find more information on the Dynatrace website.

Load data

How to implement: This example use case depends on APM data.

The app and add-on in this answer are not Splunk-supported, but are available for download from Splunkbase as an open-source tool.

Follow the documentation to install and configure the Dynatrace Add-on for Splunk from Splunkbase and to provide your Dynatrace API key. This integration includes support for the Splunk ITSI Module for Application Performance Monitoring, available on Splunkbase. Use this module to access pre-packaged ITSI key performance indicators (KPIs) from APM tools and get an overview of the health of your applications. To access a comprehensive set of visualizations, you can install the Dynatrace App for Splunk from Splunkbase.

Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.

Get insights

Find the average user actions based on past performance to predict future application usage.

Run the following search.

index=* sourcetype=dynatrace:metrics timeseriesId="com.dynatrace.builtin:app.useractionsperminute"

| stats avg(value) AS value BY _time, timeseriesId

| timechart avg(value) AS Average

| predict future_timespan=30 Average

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.