topic Re: Best way to get Windows DHCP logs to Splunk in Getting Data In

Best way to get Windows DHCP logs to Splunk

PratikPashte — Wed, 22 Sep 2021 13:09:17 GMT

Hello,

I am trying to get Windows DHCP logs to Splunk and trying to use below way to get the same, but wanted to look if there is any better way to ingest the DHCP logs to Splunk.

Using Deployment server to get the logs with inputs.conf file,

[monitor://C:\Windows\System32\dhcp]

sourcetype = dhcp

crcSalt = <SOURCE>

alwaysOpenFile = 1

disabled = false

index = dhcplogs

whitelist = Dhcp.+\.log

And then to install below app at search heads to parse the logs,

https://splunkbase.splunk.com/app/4359/#/details

I haven't completed the setup prior to that was getting some advise if this the best way to go ahead or any other way we have to ingest it better.

If this the best way is there anything i need to be aware prior to the setup, Thanks in advanced.

Regards,

Pratik Pashte

Re: Best way to get Windows DHCP logs to Splunk

Roy_9 — Wed, 22 Sep 2021 16:18:00 GMT

Install the Splunk UF on the hosts and also push this add-on to all the UF's and install it on your SH as well which makes your job easy in field extractions.

Re: Best way to get Windows DHCP logs to Splunk

PratikPashte — Thu, 23 Sep 2021 05:29:31 GMT

Which means I am on the right track, Thanks Roy.

But would also like to understand is there any other way as well to pull the DHCP logs to Splunk?

Re: Best way to get Windows DHCP logs to Splunk

isoutamo — Thu, 23 Sep 2021 05:55:35 GMT

I think that this is the easiest and best way to do it with splunk. Other ways are more complicated than this.

Re: Best way to get Windows DHCP logs to Splunk

PratikPashte — Mon, 11 Oct 2021 06:30:15 GMT

The only problem with this way is DHCP log file size on DC.

I am also trying with Splunk Stream app, but it is complicated to fulfil the use case,

MAC - IP - Hostname

Details from the logs, with stream we get all the data from DORA process and I believe DHCPREQUEST and DHCPACK is where I should get the details.

But not able to figure out the fields, mostly I should received the desired values on this fields but not always this is true.

chaddr
yiaddr
client_fqdn

Has anyone successfully configured stream for DHCP logs and have getting the logs required for asset inventory (MAC-IP-Hostname)?