Importing from export files

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/exports"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/20411a6d-8414-4127-b331-f340e0b9b829/social-card.svg?v=3e7ae33eec8b" alt="Importing from export files" width="600" height="315"></a>

wtctl import <source> --alerts <file> --dashboards <file> [--alertmanager <file>] [--apply] [--report <prefix>]

These importers read export files, so no vendor credentials are sent anywhere. A run is a dry run unless --apply is given and always writes the skip report.

Source

--alerts

--dashboards

Mapped to

newrelic

NerdGraph policies with NRQL conditions

dashboard JSON array

promql (Metric), error_rate (Transaction error percentage), log_count (Log, via the log translator); metric widgets

splunk

saved/searches?output_mode=json

none

log_count for count-threshold alerts; others listed

promrules, chronosphere

Prometheus rule file

none

promql alert rules; --alertmanager is sent to POST /v1/projects/{p}/routing:import-alertmanager (preview unless --apply)

sentry

{projects, metric_alerts, issue_alerts}

none

error_rate from failure_rate(); projects and issue alerts listed

honeycomb

triggers array

boards array (listed only)

trace_latency, trace_failure

dynatrace

Settings 2.0 metric events

dashboards array

promql; log processing rules listed

kibana

none

saved-objects NDJSON

logs panels via the KQL translator; ingest pipelines listed

Log pipelines are reported, never imported. Everything not mapped appears under Unsupported with its reason.

Sunset and acquired vendors

  • Opsgenie (end of sale), Splunk On-Call and Grafana OnCall OSS: see oncall.md.

  • Chronosphere: Prometheus rules and Grafana dashboards import as above.

  • Helicone (maintenance mode): export with npx @helicone/export --format jsonl, then wtctl import helicone --file export.jsonl --endpoint <gateway> --key <ingestion key> replays each request as a gen_ai span (model, tokens, cost, latency, user, properties; --dry-run counts only). Ids come from the Helicone response id, so a rerun is deduplicated. For new traffic, point the OpenLLMetry or OTLP exporter at the gateway.

  • Traceloop (ServiceNow), Galileo (Splunk Agent Observability): OTLP or OpenLLMetry instrumentation; change the exporter endpoint and key to the Watchtower gateway. OpenLLMetry spans are ingested as is (crates/wt-llm/src/openllmetry.rs).

Updated