topic Re: winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows in Getting Data In

Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

monug8 — Thu, 16 Feb 2023 23:13:52 GMT

Currently, I am trying to extract the DNS logs from TA_Windows where inputs.conf file has [WinEventLog: //DNS Server) disabled=0 but still not working. I am trying to get DNS logs to index (microsoft_windows) ion indexer.

I have DNS server role installed on the machine. UF is also installed but still not working. I have seen many other blogs but not exactly pointing out the solution.

Any help will be appreciated.

Thanks

Re: winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows

gcusello — Thu, 16 Feb 2023 07:32:09 GMT

Hi @monug8,

let me understand:

did you installed the Universal Forwarder on the DNS Server?

are you receiving other logs from that host?

did you enabled logging on DNS Server?

Ciao.

Giuseppe

Re: winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows

monug8 — Thu, 16 Feb 2023 22:18:41 GMT

Hi @gcusello yes, I have Installed UF on windows machine where DNS Server role is installed

yes, I am receiving other OS logs (WinEventLog:Application, Security) to splunk indexer

yes, I enabled DNS logs as per below:

#### WinEventLog Inputs for DNS ########

[WinEventLog:// DNS Server]

disabled=0

renderXml=false

index = microsoft_windwos

Still not getting DNS logs, I can see those logs in Event Viewer on windows but not appearing in Splunk indexer

Note: I am using Technical Addons called (Splunk_TA_windows)

Thanks

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

monug8 — Fri, 17 Feb 2023 03:59:24 GMT

I am wondering if any powershell script run as part of [WinEventLog:// DNS Server] ?

if yes, then we have policy to stop Powershell Script remotely, only signed powershell script is allowed.

Not sure about this @gcusello

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

gcusello — Fri, 17 Feb 2023 07:36:06 GMT

Hi @monug8,

at first check if DNS monitoring is enabled at Windows level (not in Splunk).

Then check if the user used to run Splunk has the righrs to execute Powershell scripts.

Ciao.

Giuseppe

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

scelikok — Fri, 17 Feb 2023 08:34:52 GMT

Hi @monug8,

You don't need PowerShell or another issue if you can see DNS Server events inside Event Viewer. Maybe there is a mismatch between your Event channel name and input stanza. Could please share screenshot of your EventViewer showing your DNS Server events tree and your inputs.conf stanza?

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

monug8 — Sun, 19 Feb 2023 22:25:40 GMT

@gcusello , I said in last post, we are not allowing any powershell script can be executed on DNS server so that is the issue here, you believe.

Is the DNS server log kicks off PS script as part of collecting logs from Event Viewer.

what do you mean by DNS monitoring is enabled at Windows level . is this related to DNS logging and diagnostics?

I can see DNS events in Event Viewer so it means DNS monitoring is enabled on windows level.

Thanks

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

monug8 — Sun, 19 Feb 2023 22:28:24 GMT

@scelikok I did not get it when you said mismatch. Input.Confs is pretty standard provided by Splunk Addons for Windows:

Sorry Cannot provide DNS Events, it is also pretty standard DNs events.

Thanks

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

gcusello — Mon, 20 Feb 2023 06:45:44 GMT

Hi @monug8 ,

are there in the Windows Event Viewer (not in Splunk) the events from DNS?

if yes, they already arrive in Splunk you should find them in wineventlog, if thery aren't in Windows Event Viewer, you have to enable DNS logging on Windows.

If they are in Windows Event Viewer but not in Splunk and you have other EventLogs, check if there's ome whitelist or blacklist in inputs.conf.

Ciao.

Giuseppe

Re: winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows

PickleRick — Mon, 20 Feb 2023 09:45:45 GMT

Did you copy-paste that config excerpt? Because there is most probably a typo here.

index = microsoft_windwos

If you have a last-chance index set your events would land there. If you don't, they would get discarded.

Unless of course your index is indeed called "microsoft_windwos"

Re: Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

monug8 — Mon, 06 Mar 2023 23:28:03 GMT

We have resolved DNS logs without using TA_Windows, but still I found it there are some issues with WinEventViewer for ADFS Trace logs. after enabling advanced logging on ADFS but still not getting ADFS Trace logs.