Hello Laura. I do not know much Splunk details. The simplest straightforward solution is to run it on whatever host, log results into logfile and read it by Splunk forwarder (agent). But if I check Splunk docs, i am sure Splunk has REST API connector.
So it seems that you need a script that regularly extracts user session records by USQL from Dynatrace REST API and then pushes it into Splunk REST API. Probably Splunk itself has REST API data reader that can be used to directly communicate with Dynatrace.
Regards, Igor
