# Tutorial - How to consume Dynatrace SaaS Audit logs into Splunk Enterprise **URL:** \ **Category:** Dynatrace Tips\ **Tags:** developer-community, dynatrace-saas, documentation, tips-and-tricks\ **Created:** [February 27, 2020, 2:03pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525 "2020-02-27T14:03:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![larry\_roberts](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/larry_roberts/32/7131_2.png) [@larry\_roberts](https://community.dynatrace.com/u/larry_roberts)\ **Post date:** [February 27, 2020, 2:03pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/1 "2020-02-27T14:03:07Z")
## **How to consuming Dynatrace SaaS Audit logs into Splunk Enterprise** I apologize for being so late on this tutorial. I know I promised it over a month ago. As you may or may not know, recently Dynatrace made _[Audit logs](https://www.dynatrace.com/support/help/extend-dynatrace/dynatrace-api/environment-api/audit-logs/?_ga=2.105909699.1586027855.1582807080-39620595.1582807080)_ available. This has been a long time coming and I for one am extremely happy to now have access to these. If you are a Dynatrace SaaS and Splunk Enterprise customer you must be thinking right now… > _“Nice! I am going to bring those Dynatrace audit logs into Splunk.”_ But, there are 2 roadblocks in your way that will prevent this which are… 1. Dyantrace does not schedule or push these logs. 2. Splunk Enterprise does not provide the ability to make REST calls. This is where this tutorial comes in and overcomes these 2 roadblocks, so let’s get started. This tutorial makes a few assumptions. **Dynatrace assumptions** - You are using Dynatrace SaaS. - You have an administrative account for your Dynatrace tenant(s) that allows you to generate API tokens. - You know how to utilize the _[Dynatrace API](https://www.dynatrace.com/support/help/extend-dynatrace/dynatrace-api/?_ga=2.197608047.1586027855.1582807080-39620595.1582807080)_ and more specifically, the Dynatrace _[Environment API](https://www.dynatrace.com/support/help/extend-dynatrace/dynatrace-api/environment-api/?_ga=2.173492835.1586027855.1582807080-39620595.1582807080)._ **Splunk assumptions** - You are using Splunk Enterprise on-prem. - Our Splunk enterprise instance is on-prem so this tutorial is based on Splunk enterprise on-prem. - You have an administrative account for your instance of Splunk Enterprise that allows you to install Splunk plugins. - You have an account for [_https://splunkbase.splunk.com_](https://splunkbase.splunk.com/). - You are familiar with _i_[_nstalling Splunk plugins_](https://docs.splunk.com/Documentation/AddOns/released/Overview/Singleserverinstall). * * * ### **Step #1** **Download the BaboonBones REST API Modular Input v1.6 Splunk plugin** * * * This is a great little company who develops plugins for Splunk and one of those plugins is called the “[_REST API Modular Input v1.6_](https://www.baboonbones.com/php/markdown.php?document=rest/README.md)”. This is a Splunk modular input add-on for polling REST APIs from such things as Dynatrace SaaS. You can install this plugin one of 2 ways in Splunk. **Method #1 - From within the Splunk UI** Open your instance of Splunk Enterprise and login with a Splunk admin account which has permissions to install Splunk plugins. In my case I am using Splunk Enterprise on-prem. Once logged in with administrative privileges, select “_Apps_” from the dropdown menu next to the Splunk Enterprise logo. Once on the Apps screen in Splunk Enterprise, type **REST** into the search box and hit enter. Once the results are shown, ensure you select the “_REST API Modular Input_” plugin as seen below. Within my screenshot, you can see Splunk Enterprise knows I have already installed the Splunk plugin as indicated by the button to the right which says “_Already Installed_”. In your case, that same button should provide you the ability to install the plugin. It should be noted that Splunk Enterpriise will require a [Splunkbase](https://splunkbase.splunk.com/) login to conduct the install and will prompt you when needed. ![23798-1582812296572.png](https://global.discourse-cdn.com/dynatrace/original/3X/0/b/0b4bdb6041fc480ce5b61371f64e2840d9996aca.png) **Method #2 - From Splunkbase outside the Splunk Enterprise UI** Download the plugin from Splunkbase [here](https://splunkbase.splunk.com/app/1546/). You will need a [Splunkbase](https://splunkbase.splunk.com/) account to start the download. Once you have downloaded the plugin from the [Splunkbase website](https://splunkbase.splunk.com/), log into your Splunk Enterprise instance with administrative privileges and install the plugin as you would any other Splunk Enterprise plugin. You can find help on how to install a Splunk Enterprise plugin [here](https://docs.splunk.com/Documentation/AddOns/released/Overview/Singleserverinstall) if needed. * * * ### **Step #2** **Obtain a free 7 day trial key for plugin or purchase a non expiring key for $99** * * * BaboonBones offers a free 7 day trial key so you can take it for a test drive. I would recommend using the trial first to ensure everything works as you are expecting. If you decide to purchase the plugin, BaboonBones also offers [support plans](https://www.baboonbones.com/#support) if you decided support is needed. Click [here](https://www.baboonbones.com/#activation) to obtain the free 7 day trial key. * * * ### **Step #3** **Create a Dynatrace SaaS API token** * * * Dynatrace requires REST calls to supply an API token for authorization. Login to the Dynatrace SaaS tenant you wish to collect the audit logs from with an administrative account that can generate Dynatrace SaaS tokens. Once logged in, select “_Settings_”, “_Integration_”, and then “_Dynatrace API_” as seen below. ![23834-1582812392596.png](https://global.discourse-cdn.com/dynatrace/original/2X/a/ad67e4a4b5a527824b88743b3fe72467e42bdf4d.png) Once on the Dynatrace API screen in the UI, select the button for “_Generate token_”. Note that you can name this token however you like. ![23799-1582812435671.png](https://global.discourse-cdn.com/dynatrace/original/2X/c/cd82f8b051835926c038b1e4e337b013e4e95080.png) For the permissions, only enable the “_Read audit logs_” toggle switch and then press the “_Generate_” button at the bottom of the screen. ![23835-1582812463488.png](https://global.discourse-cdn.com/dynatrace/original/3X/3/1/31f7f68c30aea653b5aa955dd52c6aae60b6d8ca.png) Dynatrace will then show the newly generated token. Press the “_Copy_” button to take a copy of this token into your clipboard. Note that you can always return to this API screen at any time to retrieve the generated token as needed. ![23786-1582812479472.png](https://global.discourse-cdn.com/dynatrace/original/3X/2/5/25076e2b306fbd2d21d74b92827d3a702a43c089.png) * * * ### **Step #4** **Configure the Splunk Enterprise Data inputs** * * * You should still be logged into Splunk Enterprise within an administrative account at this time. Within Splunk Enterprise, select “_Settings_”, “_Add Data_”, and then “_Data inputs_” as seen below. ![23820-1582812503609.png](https://global.discourse-cdn.com/dynatrace/original/3X/e/8/e8354c927efd673b41b75f79d03758ced02ae463.png) Next select “_REST API input for polling data from RESTful endpoints_” from the list that is shown. ![23827-1582812513759.png](https://global.discourse-cdn.com/dynatrace/original/3X/8/c/8c63287fabe5a1267814488eb767a4835df0ca16.png) There are 9 key configurations that must be completed on this screen which are as follows: **Activation key** This will be the free 7 day trial key or purchase key you received via email from BaboonBones. **Endpoint URL** This will be the endpoint for your Dynatrace SaaS tenant API along with the generated token you created above. The URL should be constructed as follows: https://_ **\** _.dynatrace.com/api/v2/auditlogs?sort=timestamp&Api-token=_ **\** _ **HTTP Method** Select “_GET_” from the dropdown list. **Authentication Type** Select “_none_” from the dropdown list. **Response Type** Select “_json_” from the dropdown list. **Response handler** Type in “_DynatraceCustomReponseHandler_”. **Polling interval** I would highly recommend no less than 3600. **Set sourcetype** Select “_Manual_” from the dropdown list. **Source type** Type in “_dynatrace\_audit_” or use whatever you would like as the source type in Splunk Enterprise for Dynatrace logs. Once you have verified you have all fields completed correctly, press the “_Save_” button at the bottom of the screen. Below is a screenshot for you to compare too. ![23836-1582812545033.png](https://global.discourse-cdn.com/dynatrace/original/3X/5/c/5cc39ebc750d34a84a8177e3b4bfa72339d5a12d.png) * * * ### **Step #5** **Provide a nice clean syntax for the json in Splunk Enterprise** * * * In order to clean up from json to a normal Splunk type format, you now need to edit the file called “_responsehandlers.py_” for the Splunk Enterprise plugin you installed. In my case, we have Splunk Enterprise installed on a Linux host. The“_responsehandlers.py_” file can be found within the “_splunk/default/etc/apps/rest\_ta/bin_” directory. Once you locate the “_responsehandlers.py_” file, you will need to edit the file and add the following class logic to the contents. This can really be placed just about anywhere within the file. ![23837-1582812586470.png](https://global.discourse-cdn.com/dynatrace/original/3X/5/7/576af40a93ee3cdc7eec8fcabd429b716cea7c11.png) Once added, ensure you save the newly edited “_responsehandlers.py_” file. This class takes what you would normally see via json output as in the example below and turns it into nice clean Splunk Enterprise entries that are indexed and searchable via the Splunk Enterprise sourcetype you configured above. * * * ## _ **That’s it!** _ At this point you need to restart Splunk Enterprise. Once Splunk Enterprise has completed the restart, wait about a minute and then give it a test run. Do a Splunk Enterprise search using sourcetype=”dynatrace\_audit” OR use whatever Splunk Enterprise sourcetype you defined in the configuration above. The results should look something like the following. ![23842-1582812779648.png](https://global.discourse-cdn.com/dynatrace/original/3X/f/5/f5e3aa2a13f0a7ea8a8efe34bdeb9a656e2708d6.png) # _ **Enjoy!** _ ![1582812261353.png](https://global.discourse-cdn.com/dynatrace/original/2X/4/4013e3988fdcaa0e62ff0d1ef46c2250f3299cda.png) ---
**Author:** ![MaciejNeumann](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@MaciejNeumann](https://community.dynatrace.com/u/MaciejNeumann)\ **Post date:** [February 27, 2020, 2:14pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/2 "2020-02-27T14:14:52Z")
Thank you so much for this tutorial and the work put in it! From the moderator point of view, it’s so amazing to see this kind of engagement and knowledge from the users. ---
**Author:** ![ChadTurner](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/chadturner/32/161_2.png) [@ChadTurner](https://community.dynatrace.com/u/ChadTurner)\ **Post date:** [February 27, 2020, 2:31pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/3 "2020-02-27T14:31:04Z")
Thanks [@Larry R.](https://answers.dynatrace.com/users/24228/view.html) for posting this. We are going to try the addons/plugins one more time and then resort to the API as you have done. Very exciting stuff! thanks again! ---
**Author:** ![larry\_roberts](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/larry_roberts/32/7131_2.png) [@larry\_roberts](https://community.dynatrace.com/u/larry_roberts)\ **Post date:** [February 27, 2020, 3:00pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/4 "2020-02-27T15:00:37Z")
You’re welcome! As a side note… I first tried the Dynatrace addons as well. I found them to be very dated and no longer kept up to date. This is what took me down this route. Plus I was not concerned with getting anything else from Dynatrace into Splunk outside of just the audit logs. Good luck! ---
**Author:** ![Yosi\_Neuman](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/yosi_neuman/32/9845_2.png) [@Yosi\_Neuman](https://community.dynatrace.com/u/Yosi_Neuman)\ **Post date:** [April 19, 2020, 1:50pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/5 "2020-04-19T13:50:33Z")
WOW [@Larry R.](https://answers.dynatrace.com/users/24228/view.html) that’s is a great and detailed one Thanks a lot ! Yos ---
**Author:** ![Domenico\_Bressi](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/domenico_bressi/32/7142_2.png) [@Domenico\_Bressi](https://community.dynatrace.com/u/Domenico_Bressi)\ **Post date:** [April 19, 2020, 9:36pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/6 "2020-04-19T21:36:04Z")
Great tutorial [@Larry R.](https://answers.dynatrace.com/users/24228/view.html) ---
**Author:** ![larry\_roberts](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/larry_roberts/32/7131_2.png) [@larry\_roberts](https://community.dynatrace.com/u/larry_roberts)\ **Post date:** [May 5, 2020, 12:18pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/7 "2020-05-05T12:18:59Z")
You’re welcome! Happy to help. ---
**Author:** ![larry\_roberts](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/larry_roberts/32/7131_2.png) [@larry\_roberts](https://community.dynatrace.com/u/larry_roberts)\ **Post date:** [May 5, 2020, 12:19pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/8 "2020-05-05T12:19:19Z")
Thanks! Enjoy ---
**Author:** ![larry\_roberts](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/larry_roberts/32/7131_2.png) [@larry\_roberts](https://community.dynatrace.com/u/larry_roberts)\ **Post date:** [May 5, 2020, 12:20pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/9 "2020-05-05T12:20:36Z")
You’re welcome. I would love to see more of this type of thing. Maybe even a tutorial area of the forum where people could post them. ---
**Author:** ![jegron](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/jegron/32/12797_2.png) [@jegron](https://community.dynatrace.com/u/jegron)\ **Post date:** [November 3, 2022, 10:18pm UTC](https://community.dynatrace.com/t/tutorial-how-to-consume-dynatrace-saas-audit-logs-into-splunk-enterprise/28525/10 "2022-11-03T22:18:52Z")
Hi [@larry\_roberts](https://community.dynatrace.com/user/33677) ! Great job ! We are working on an addon. Did you find a way to replace \_time by timestamp from Dynatrace Audit Log ? Also do you have some dashboards to share? 🙂