Creator of a new, unknown dashboard

davidvm02-giss — Thu, 23 Apr 2026 07:18:58 GMT

Good afternoon,
We have noticed that new dashboards have been created in our environment, and instead of the name of the user who created them, an identifier appears.
We are trying to determine the origin of this creation using the audit log, in case it was generated by a token call to the API, an external source, or some other possibility.
Could you help me find this information via the audit log or another method?
Many thanks and best regards, David.

Re: Creator of a new, unknown dashboard

MaximilianoML — Wed, 22 Apr 2026 15:15:25 GMT

Hello @davidvm02-giss,

Yes, you should be able to investigate this through Dynatrace Audit Logs.
If a dashboard shows an identifier instead of a normal user name, it often means it was created by a non-interactive identity such as an API token, OAuth/service user, or automation rather than directly from the UI.

Maybe this query helps you to figure out:

fetch dt.system.events | filter event.kind == "AUDIT_EVENT" | filter contains(toString(resource), "dashboard") or contains(toString(content), "dashboard") | sort timestamp desc

I hope it help 😀

topic Creator of a new, unknown dashboard in Dashboarding

Creator of a new, unknown dashboard

Re: Creator of a new, unknown dashboard