topic Splunk Add-on for Infoblox compatibility with Splunk & ES version 10 in Getting Data In

Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

USA69 — Mon, 29 Jun 2026 18:33:41 GMT

https://splunkbase.splunk.com/app/2934 is it compatible with Splunk enterprise & ES 10.0.4 even though it's archived. Not seeing the following fields

in Data Model Network_Resolution Fields:

DNS.src

DNS.src_category

DNS.message

DNS.reply_code

DNS.record_type

DNS.query

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

livehybrid — Mon, 29 Jun 2026 21:58:06 GMT

Hi @USA69

This is a Splunk supported addon, therefore I would recommend raising a support case with these details and you should hopefully get this raised directly to the correct team internally.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

PickleRick — Tue, 30 Jun 2026 17:46:02 GMT

The addon lists the DNS datamodel as one supported for infoblox:dns sourcetype so I would expect it to work.

Having said that - have you verified that your input side is properly configured? And that the source is properly configured to emit properly formatted events? (I don't have much experience with this particular solution but often add-ons rely on some specific configurations on the source side; or sometimes there is something "in between" that messes up the events so they reach Splunk in a different format than add-on creators assumed).

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

USA69 — Wed, 01 Jul 2026 12:57:03 GMT

The add-on does not have inputs.conf configured on the default. And it's sending the logs via syslog-ng. Do I still need to create the inputs.conf on the local folder? And will appreciate if you can very if this is the correct configuration for inputs.conf below

[udp://514]
connection_host = ip
sourcetype = infoblox:syslog
index = infoblox

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

PickleRick — Wed, 01 Jul 2026 15:09:51 GMT

OK. If you're receiving your syslogs through an external component, make sure the resulting combined configuration of the ingesting side doesn't modify the events in a way that they don't match the assumed format. You don't have to define additional input on your Splunk box directly.

Are your events correctly sourcetyped? As far as I remember, the addon does some sourcetype-casting depending on the type of events you're receiving so even though your sourcetype should be configured as infoblox:syslog in your syslog-ng configuration (or - if you're using intermediate files - your file inputs reading the files must set that sourcetype) but after ingestion the events should be indexed as - in your case - infoblox:dns sourcetype. Does it match your situation?

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

USA69 — Thu, 02 Jul 2026 14:01:47 GMT

It was configured through Cribl to send the logs to Splunk. the sourcetype is infoblox:dns

source is infoblox

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

PickleRick — Thu, 02 Jul 2026 16:10:26 GMT

With that much information can't tell anything more. You have to check whether Cribl does something to your events (we don't know that), whether the events fit the extractions defined in the TA (can use regex101 for that).

Re: Splunk Add-on for Infoblox compatibility with Splunk & ES version 10

USA69 — Mon, 06 Jul 2026 11:13:46 GMT

Thanks for the update