Splunk to Dynatrace: Moving Logs, Searches and Alerts
Log costs are one of the most common reasons organisations look again at Splunk, and Dynatrace is often on the shortlist because it keeps logs alongside metrics, traces and topology in one platform. Here is how the two charge for logs, what a move involves, how SPL searches translate, and where keeping Splunk is still the right answer.
Our position, before you read on. C4C Group is an official Dynatrace partner and we migrate organisations onto Dynatrace. We are also independent, and Splunk remains a strong platform, particularly for security operations. We do not quote prices for either vendor; we explain how each one charges and link to their own pages.
Moving operational logs from Splunk to Dynatrace means re-routing collection, rebuilding the searches and alerts you actually use, and running both in parallel until teams trust the new platform. Dynatrace stores logs in Grail next to metrics, traces and the dependency map, so a log line can be tied straight to the service and problem it relates to. It meters logs separately on ingest, retention and query, which gives you levers Splunk's models do not. Many organisations move operational logs and keep Splunk for security, at least for a while.
How each one charges for logs
Neither price list is reproduced here, because your rates are set in your own contract. What matters is what is counted.
- Splunk offers several models. Ingest pricing is based on gigabytes of data ingested. Workload pricing is based on the compute and storage needed to run search and analytics, measured in Splunk Virtual Compute units on Splunk Cloud Platform and in vCPUs on Splunk Enterprise. Splunk Cloud Platform also offers an activity based model that meters both ingest and search. Splunk, pricing models.
- Dynatrace meters logs in three parts: gigabytes ingested and processed, gigabytes retained per day, and gigabytes scanned by queries, or alternatively retention with an allowance of included queries. Retention can be set per log bucket from one day to ten years. All of it draws on one Dynatrace Platform Subscription. Dynatrace, Log Analytics; Dynatrace licensing from C4C.
The practical difference is control. With ingest, retention and query metered separately, you can keep high volume, low value logs for a short time, keep audit logs for years, and decide which data is searched often. That only saves money if someone designs the buckets and retention rules properly. Estimate your log costs.
Why logs in Dynatrace work differently
In Splunk, logs are usually the centre of the investigation: you search, then correlate. In Dynatrace®, logs sit in Grail® alongside metrics, traces, user sessions and the Smartscape® dependency map, and OneAgent® can enrich them with the host, process and service they came from. When a problem is raised, the relevant logs are already attached to it. OpenPipeline® handles ingest and processing, so filtering, masking, parsing and routing to the right bucket happen before data is stored. Dynatrace, OpenPipeline.
From SPL to DQL
Splunk searches are written in SPL; Dynatrace uses DQL. The concepts are close enough that experienced Splunk users pick DQL up quickly, and Dynatrace publishes an official comparison of DQL with SPL, SQL and KQL. Dynatrace, DQL compared with other query languages. Two simple examples:
| Task | SPL | DQL |
|---|---|---|
| Count by type | stats count by event.type | summarize count(), by:event.type |
| Filter results | | where ... | | filter ... |
Dynatrace does not publish an automatic SPL to DQL converter, so saved searches, dashboards and alerts are rebuilt rather than copied. That is a good moment to retire the many saved searches nobody runs.
If Splunk is your security information and event management platform, think about operations and security separately. Moving operational and application logs to Dynatrace, where they sit next to the telemetry engineers use, often delivers most of the benefit. Moving security detections, correlation searches and compliance reporting is a separate decision with its own risks and timing. Do not let one drag the other.
A migration plan that avoids a gap
- Inventory. List log sources, daily volumes, indexes, retention, saved searches, alerts and dashboards, and mark which are actually used and by whom.
- Design. Map indexes to Dynatrace buckets with retention per bucket, set OpenPipeline rules for parsing, masking and filtering, and agree permissions.
- Run in parallel. Send selected sources to Dynatrace while Splunk carries on, and compare. The right collection method depends on how logs are gathered today, through OneAgent, OpenTelemetry or existing forwarders.
- Rebuild what matters. Recreate the searches, alerts and dashboards teams rely on in DQL, and switch alerting only when the owning team signs it off.
- Cut over and reduce. Turn off sources in Splunk as each wave completes, and reduce the Splunk licence at renewal rather than paying for two platforms.
Dynatrace offers its own log advisory and log migration services covering assessment, design and migration from Splunk. Dynatrace, Dynatrace and Splunk. Partners such as C4C run the whole programme, including the commercial timing.
How we help
We are an official Dynatrace partner. We size log volumes and retention before you commit, design the buckets and pipelines so the cost stays where you expect, run the parallel period and rebuild what matters, and time it all to your Splunk renewal. Our people spent decades on the vendor side, so we know how to reduce one contract while starting another without paying twice for longer than necessary. Migration to Dynatrace.
Looking at moving logs off Splunk?
Tell us your rough daily log volume, which Splunk products you use and when they renew. We will give you a straight view on what should move, what should stay, and what the move involves. We supply, implement and migrate to Dynatrace.
Prefer email? Reach us directly at hello@c4cgroup.co.uk.
Frequently asked questions
Can Dynatrace replace Splunk?
For operational and application logs, often yes: Dynatrace stores logs in Grail alongside metrics, traces and the dependency map, and ties them to the services and problems they relate to. Where Splunk is also your security platform, treat that as a separate decision, and many organisations keep Splunk for security while moving operational logs.
How does Dynatrace charge for logs compared with Splunk?
Dynatrace meters logs separately on gigabytes ingested and processed, gigabytes retained per day and gigabytes scanned by queries, or retention with included queries, all drawn from one platform subscription. Splunk offers ingest based pricing by gigabytes ingested, workload pricing by compute capacity, and on Splunk Cloud Platform an activity based model metering ingest and search.
Is there a tool to convert SPL to DQL?
Dynatrace does not publish an automatic SPL to DQL converter. It publishes an official comparison showing how SPL commands map to DQL, for example stats count by becomes summarize count(), by. Saved searches, alerts and dashboards are rebuilt, which is a good opportunity to retire the ones nobody uses.
How long should Splunk and Dynatrace run in parallel?
Long enough for each team to trust the new searches, alerts and dashboards for their own services, moved in waves rather than all at once. Plan the whole migration backwards from your Splunk renewal date so you can reduce the Splunk licence then rather than paying for both longer than necessary.
Does Dynatrace offer help migrating from Splunk?
Yes. Dynatrace offers log advisory and log migration services covering assessment, design and migration from Splunk. Partners such as C4C can run the programme end to end, including sizing log volumes and retention and timing the move to your Splunk contract.