The iplocation functionality is native to Splunk, the only piece I think could fail here would be if the IPs that are coming in are not in Splunk's IP Location lookup table. This could happen if the IPs are LAN ips and not public IPs. Are these visits coming in from an external facing application? ... View more

@SuganyaSSF Do you see any data if you run a new search: index="dynatrace" sourcetype="visit" If not, you might not be sending any visits from Dynatrace to Splunk. Make sure you have added the catch-all business transactions from the system profile located on this Dynatrace community page as a good starting point: https://community.dynatrace.com/community/display/DL/Splunk+Application There is some additional documentation there on getting things setup as well. ... View more

@SuganyaSSF: If you load the report via "Searches and Reports" -> User Analytics: Visit by Client IP do you see any results? That particular dashboard and the underlying report has been refactored in version 2.3.0 of Dynatrace Splunk app. It no longer has external dependencies to other plugins and utilizes out of the box Splunk functionality for geolocating IPs and for visualizing the data. The search should be: index="dynatrace" sourcetype="visit" | rename dimensions."Client IP Address of Visit" as clientip | iplocation clientip | geostats latfield=lat longfield=lon count If you do not export any visit based Business Transactions from Dynatrace you will not have any data to populate the search. hope this helps! ... View more

In case this comes up in the search results for other folks experiencing this issue a fix has been created and uploaded as part of the 2.3.0 release of this app. The fix was to change the line defining appdir in the runFlume.py to the following: appdir = os.path.abspath(os.path.join(os.path.dirname(__file__),"..")) ... View more

Old post but version 2.3.0 of the app was uploaded today which should fix the edge cases resulting in the classpath not being properly enumerated. The fix was to update the line defining appdir in the runFlume.py to the following: appdir = os.path.abspath(os.path.join(os.path.dirname(__file__),"..")) ... View more

Version 2.3.0 of the Dynatrace AppMon Splunk app has been uploaded which includes a refactored Visits On a Map dashboard for Splunk 6.5.x: https://splunkbase.splunk.com/app/1593/ ... View more

Hello Chintan. We don't currently support the export of transaction flow and API breakdown data out of Dynatrace AppMon at this time as the data model would be difficult to consume and render in third party tools like Splunk. I would recommend posting this suggestion on the RFE section of the Dynatrace Community forums. This area of the Dynatrace Community should be accessible to customers with active community accounts: https://answers.dynatrace.com/spaces/151/product-feedback-and-enhancement-requests.html hope this helps! ... View more

Also, for some more information on installations in an environment with multiple search-heads I believe Flume will be running on all of them so you can simply select one of those hosts for configuration in the Dynatrace client. ... View more

The Splunk app includes Flume as well as start scripts and configuration files necessary to decode the protobuf data being sent by the Dynatrace Big-Data Transaction Bridge. The Splunk app also includes sample searches, visualizations and dashboards that are meant as examples for utilizing the data transmitted by Dynatrace into Splunk. The only pre-requisites for the app is the installation of java on the Splunk host running the app as well as the GoogleMaps and MaxMind Splunk apps if you would like the included dashboards to work. If you are not interested in the included sample dashboards you could avoid installation of those apps. The app will not cleanly support clustered environments at this time as installation of the app would result in multiple instances of Flume across multiple hosts. If you are utilizing a clustered or more complex Splunk environment our recommendation is to utilize the Dynatrace BigData Transaction Bridge (https://community.dynatrace.com/community/display/DL/Big+Data+Business+Transaction+Bridge) on something like a forwarder to consume the protobuf stream from Dynatrace and write that data onto the forwarder's disk and then have that data indexed in Splunk. ... View more

It seems that about 1 in every 1000 installations of the app result in the classpath being improperly constructed by the Python script that starts Flume. You can resolve this issue by editing the following lines in /%SPLUNK_HOME%/etc/apps/compuwareapm/bin/runFlume.py: c1 = os.path.join(appdir, "bin", "apache-flume-1.3.1-bin", "lib", "*") c2 = os.path.join(appdir, "bin", "apache-flume-1.3.1-bin", "lib", "flume-ng-node-1.3.1.jar") c3 = os.path.join(appdir, "bin", "dtFlume.jar") remove the leading "bin" so that the lines read: c1 = os.path.join(appdir, "apache-flume-1.3.1-bin", "lib", "*") c2 = os.path.join(appdir, "apache-flume-1.3.1-bin", "lib", "flume-ng-node-1.3.1.jar") c3 = os.path.join(appdir, "dtFlume.jar") I have been unsuccesfully trying to nail down the source of this issue for quite some time, It appears that on some Splunk environments appdir = os.path.dirname(os.path.dirname(__file__)) will result in /%SPLUNK_HOME%/etc/apps/compuwareapm and in other environments it will result in /%SPLUNK_HOME%/etc/apps/compuwareapm/bin. ... View more

Looks like this question has been answered on the Dynatrace community by one of our users: https://community.dynatrace.com/community/pages/viewpage.action?spaceKey=DL&title=Splunk+Application&focusedCommentId=218267991 for those who do not have access to our community here is Tahir's answer: he reason you are not seeing this option in your events is due to app permissions for the drill down work flow. In Splunk please go to settings->workflows->dT drill down workflow in the permissions include all apps. BTW for me the drill down only works a small percentage of the time. You may see an error in the dT client just ignore it and let the purepath search run in the background for a few min. ... View more

We have some additional documentation available on our community portal here: https://community.dynatrace.com/community/display/DL/Splunk+Application The documentation above includes a link to an additional download Dynatrace system profile with a pair of catch-all business transactions which can be loaded into your active system profile to export all user-actions and visit data from the active environment. hope this helps! ... View more

@srisahitya_v: Typically issues with the Dynatrace plugin are related to one of four items: Lack of Java on the Splunk host. The Dynatrace Splunk plugin currently requires the presence of Java on the Splunk host so that the Flume process that listens for data can run. Firewall preventing connectivity to Flume. Please ensure that connectivity exists between your Dynatrace server and Splunk server. Configuring the Dynatrace Business Transactions Feed to connect to the Splunk port rather than the Flume port. Remember that Dynatrace needs to connect to Flume, not Splunk. It will utilize port 4321 by default. Not configuring a Dynatrace Business Transaction for export. No data will be exported unless a Business Transaction is configured within Dynatrace to export data. This is done by right clicking on the business transaction within the Dynatrace client and ensuring the checkbox for "Export results via HTTP" is enabled. This configuration change is not retroactive and will only take place for new transactions coming into the environment monitored by Dynatrace. Please don't hesitate to contact me directly via email at michael.villiger at dynatrace.com if none of the above solutions are applicable! thanks! ... View more

Good find! It would appear the windows decision tree within the start script is not checking for the existence of the file first. We'll get that fixed ASAP. ... View more