What's new in Dynatrace SaaS 1.347

• Release notes
• 16-min read
• Updated on Sep 03, 2026
• Rollout start on Sep 08, 2026 (planned)

This page showcases new features, changes, and bug fixes in Dynatrace SaaS version 1.347. It contains:

Feature updates

Account Management | Cost Management

Billing report no longer shows the current day in the booked-costs chart

The Billing report no longer displays the current day in the booked costs to date chart. Previously, today's cumulative cost appeared identical to yesterday's because no costs had been booked yet for the current day, which could suggest that monitoring had stopped. The chart now ends at the previous day, showing only complete, accurate data.

Account Management | Subscriptions and Licensing

Delegate Dynatrace account setup after an AWS Marketplace private offer

After accepting a private offer on AWS Marketplace, you can now delegate the Dynatrace account setup and linking process to the appropriate team member, better aligning responsibilities with customer personas and reducing onboarding friction.

Application Observability | Distributed Tracing

Investigate traces in a side overlay without changing or modifying your current view in Distributed Tracing

The trace waterfall now opens as a focused side overlay directly in Distributed Tracing, so you can inspect a trace without changing or modifying your current view. The underlying view stays visible and interactive, giving you a cleaner investigation surface, and keeping your chart, filters, selection, and context visible throughout.

Investigate traces in a side overlay

Application Observability | Live Debugger

GitLab, Bitbucket, and Azure DevOps Live Debugger integration migrated to Dynatrace Integrations organization

The GitLab, Bitbucket, and Azure DevOps OAuth applications used by Live Debugger integrations have moved from legacy Rookout organizations to official Dynatrace-owned organizations, so you now authenticate against a Dynatrace-owned OAuth application.

Application Observability | SLO

Burn rate alerting for SLOs

Multi-window burn rate alerts are now available for SLOs. An alert fires only when the burn rate breaches its threshold in both the long and the short window at the same time. Transient spikes that self-heal, a pod restart, an autoscaling burst, or a Lambda cold start stop paging anyone, while a sustained burn still reaches you within minutes. You set the long window and the short one derives from it at the Google SRE workbook ratio, so the pairing is right without tuning. Both window values travel with the Davis problem, so root cause analysis starts from a confirmed signal. You configure these alerts through the API.

Application Security | Security Posture Management

Upgraded golang library to version 1.26.5 in Kubernetes Node Configuration Collector (NCC)

The Node Configuration Collector image now builds on Go 1.26.5 (up from 1.26.4) and upgrades golang.org/x/sys to v0.46.01. This is a maintenance update that incorporates upstream bug fixes and security patches in the Go toolchain and standard library, with no change to Collector behavior.

Infrastructure Observability

Automatically create Dynatrace Problems for Data pipeline failures and degradations detected by definity Data Observability extension

Data pipeline failures and degradations detected by definity | Agentic Data Engineering for the Lakehouse & Spark now automatically create Dynatrace Problems with enriched metadata, bringing pipeline incidents into the unified Dynatrace incident feed alongside application and infrastructure alerts.

Infrastructure Observability | Kubernetes

Improved accessibility in the Kubernetes app

Starting with Kubernetes version 1.44, accessibility has been significantly improved based on findings from a full external WCAG 2.1 audit.

These improvements make Kubernetes more usable for people relying on assistive technologies such as screen readers and keyboard-only navigation.

What's improved:

Platform

New self-monitoring metric tracking the number of metric keys

A new self-monitoring metric, dt.sfm.metrics.metric_keys, tracks the number of distinct metric keys in your environment, giving you better visibility for troubleshooting.

Platform

Deprecation of Extension Framework 1.0 JMX & PMI extensions (plugins)

JMX/PMI Extensions Framework 1 (EF1) is now deprecated for Dynatrace SaaS deployments.

Platform | DQL

New record-handling functions and fieldsMove command in DQL

DQL introduces a new family of record-handling functions and a new command to group root-level fields into nested records.

New family of record functions

The functions make it easier to inspect, decompose, and reconstruct record-typed values in DQL:

New fieldsMove command

The fieldsMove command moves root-level fields matching an include pattern (minus any excluded fields) into a new nested record field, removing them from the root level:

| fieldsMove fieldName [, include: {pattern1 [, pattern2, ...]}] [, exclude: {pattern1 [, pattern2, ...]}]

At least one of include: or exclude: must be specified to prevent accidentally moving all fields. This command is the natural counterpart to fieldsFlatten—one gathers fields into a record, the other spreads them back out. It extends the family of fields commands such as fieldsRemove, fieldsRename, and fieldsKeep.

Platform | DQL

Extract and flatten JSON fields with the new jsonExtract DQL command

The new jsonExtract command in DQL enables you to parse JSON strings and automatically extract root-level keys as record fields. It's perfect for flattening complex JSON log data for easier analysis and querying.

Key capabilities:

For details, see DQL extraction and parsing commands.

Platform | OpenPipeline

Use new Dynatrace platform features with your OpenTelemetry data

OpenTelemetry attributes are now automatically normalized to Dynatrace Semantic Dictionary fields on ingestion across logs, spans, and metrics. This means log facets, quick filters, segments, and permission models built on Semantic Dictionary fields work with your OTel data out of the box. Original OTel attributes are preserved alongside mapped fields, so your existing DQL queries remain unaffected.

Platform | Smartscape

Explore call chains and linked problems from any Smartscape node

Follow a Smartscape node's call chain across multiple hops, not just its direct neighbors. New downstream and upstream views show every node the focused entity calls and every node that calls it, level after level, from any node, not only services.

Chains load progressively: the first levels render immediately, and a + node at the graph’s frontier pulls in more on demand.

It turns reachability questions, like "Does this eventually call that database?", into something you answer at a glance. Chains are scoped to a single entity, so you don't need to click through the chain node-by-node or scan the whole graph. The chains are built on Smartscape topology rather than sampled trace data, so they show every possible path through your dependencies. This helps you weigh the downstream blast radius before a change or the upstream risk during an incident.

A new problem view does the same for Dynatrace Problems. It shows all active problems the focused node is tied to: the ones it's the root cause of, the ones affecting it, and the ones related to it. Where a node's badge only counts the problems affecting it, this view labels each relationship, so you can see whether the node is a cause or just caught up in a problem. It complements the environment-wide Problem graph, which maps your whole environment, while this stays scoped to the entity you're on. It also lives in the same menu as the call-chain and hierarchy view modes, so you move between them without switching context or apps.

Platform | SSO

JWT scope compression improvements

JWT scope compression has been improved to reduce the token size, preventing incidents caused by tokens exceeding the HTTP header size limit as the permission model grows.

Threat Observability | Security events

Hunt emerging threats across your environment with the Threat Hunting agent

The Dynatrace Threat Hunting agent searches your logs, spans, and security detections for the indicators of compromise in a threat report, then scores how exposed you are. Hand it a report URL, pasted text, a STIX feed, or a list of indicators.

Hunts cover recent log, span, and detection telemetry and report how far back they looked, so a result showing no exposure is a real answer rather than a gap in the search. Start one from the threat intelligence ready-made dashboards, via Assist or in agentic workflows.

Threat Observability | Security events

Stay ahead of emerging threats with STIX/TAXII integration

You can now pull threat reports and their indicators of compromise from any STIX/TAXII 2-compatible feed. This helps your team assess exposure across a broad range of intelligence sources and act before attackers do.

For setup instructions, see Ingest STIX/TAXII threat reports.

Threat Observability | Security events

Stay ahead of emerging threats with Recorded Future

You can now pull Recorded Future Analyst Notes and their indicators of compromise into Dynatrace as threat reports. This lets your team leverage curated, expert-sourced intelligence to assess exposure and act before attackers do.

For setup instructions, see Ingest Recorded Future threat reports.

Breaking changes

Application Observability

OneAgent end-of-life version connection enforcement

Starting with this release, Dynatrace rejects connections from OneAgent versions 1.241 and earlier.

Action plan: If you’re running OneAgent versions 1.241 or earlier, upgrade to a supported OneAgent version to avoid data loss and connectivity issues, and to benefit from enhanced security and features unavailable in earlier OneAgent versions.

For details, see End-of-life announcements.

Application Observability

URL path pattern matching conditions now consider calculated http.route values

URL path pattern matching conditions now also consider calculated HTTP.route values, correcting a previous inconsistency where these values were ignored.
Because the matching behavior changes, rules that relied on the previous behavior might match differently.

Action plan: Review your URL path pattern conditions and confirm they still match as intended now that calculated HTTP.route values are included.

Application Observability | Services

Improved Endpoint Naming Pattern for SDv1 and SDv2 and {URL:Path-Clean}

For customers using URL truncation (Service Detection v2, or Service Detection v1 with enhanced endpoint naming enabled), volatile path segments are now handled differently.

Previously, when a volatile path segment (numeric ID, UUID, IP address, IBAN, hex token) was detected, the derived HTTP route was truncated at that point. With this change, volatile segments are no longer dropped. Instead, they’re replaced with typed placeholders, and path processing continues for the full path:

Action plan: Review any endpoint naming rules, dashboards, or alerts that depend on truncated HTTP routes, as volatile path segments are now replaced with id or token placeholders rather than being dropped. If the naming changes disrupt your setup, request a temporary disablement of the sdv1-sdv2-improved-route-and-clean-path feature flag.

Cost Intelligence

Billing usage events moving from entity IDs to Smartscape IDs for Application and Infrastructure Observability, Container Observability, and Application Security

Dynatrace is transitioning customers from the Dynatrace Classic Monitored Entity (ME) model to the latest Dynatrace Smartscape IDs. The following table maps the legacy entity IDs to their new Smartscape node equivalents for each affected monitoring area. You identify which identifiers in your custom DQL queries need updating.

Action plan: If you have custom DQL queries referencing dt.entity.host, dt.entity.kubernetes_cluster or dt.entity.cloud_application_namespace, update them to use dt.smartscape.host, dt.smartscape.k8s_cluster and dt.smartscape.k8s_namespace respectively. The ready-made usage dashboards are updated automatically on the latest Dynatrace.

Platform | SSO

SCIM user pagination now follows RFC 7644 startIndex semantics

The SCIM GET /Users endpoint now interprets startIndex as the absolute, 1-based index of the first result, per RFC 7644, and computes the offset as startIndex-1. Previously, it treated startIndex as a page number, causing records to be skipped on the second and later pages. If your SCIM client relied on the old page-number behavior, update it to pass absolute record indexes.

Action plan: If your SCIM client relied on the previous page-number behavior of startIndex, update it to pass absolute record indexes.

Fixes and maintenance

Resolved issues in this release (SaaS)