topic SEDCMD help with Windows DNS logs in Getting Data In

SEDCMD help with Windows DNS logs

chemc — Wed, 19 Oct 2011 13:38:05 GMT

I am trying to use the SEDCMD when indexing Windows DNS logs as described in this solution:
http://splunk-base.splunk.com/answers/4546/field-extraction-regex-fu-help In a nutshell the Windows DNS logs have the domain name being queried in this format: (6)images(6)google(3)com(0) and I need them in this format images.google.com

I added these items to my props.conf in /opt/splunk/etc/system/local:

[source::/home/dnsuser/Downloads/dns1.log]
sourcetype = windns

[windns]
SEDCMD-domainname = s/($\d$)/./g

Then I restarted Splunk, created a new index called DNS and a new data input for the file /home/dnsuser/Downloads/dns1.log. In the data input I manually specified windns as the source type. The data is in there and my field extractions specified in transforms.conf are working fine as I can see them by specifying either index=dns or sourcetype=windns.

The domain name is extracted to a field called dns_query. When I view that field in the search results the domain name has not been modified by the SEDCMD. I know the syntax of the SEDCMD is correct because I can use it this way and the domain names are in the proper format:

index=dns | rex "((?(\w+((\d))){1,}?)$)" | rex mode=sed field=dns_query "s/($\d$)/./g"

Any help would be appreciated.

Re: SEDCMD help with Windows DNS logs

ageld — Tue, 07 Feb 2012 19:02:41 GMT

I am having the same issue. On the Universal forwarder (Windows host) I have configured the following in $SPLUNK_HOME/etc/system/local/props.conf:

[sourcetype::DNSSrvLog]
SEDCMD-dns_name = s/(($\d+$)/./g

and logs appeared not changed on the indexer

I tried different REGEXes. The one above. The ones below:

s/($\d+$)/./g

s/$\d+$/./g

s/(\d+)/./g

None of that worked. Any assistance will be appreciated.

Re: SEDCMD help with Windows DNS logs

the_wolverine — Tue, 12 Jun 2012 17:24:01 GMT

If you're using a LightForwarder or Universal Forwarder the SEDCMD configuration needs to exist on the indexer(s) which actually performs the parsing work.

Re: SEDCMD help with Windows DNS logs

landen99 — Mon, 19 Mar 2018 20:56:00 GMT

SEDCMD doesn't work on the UF

Re: SEDCMD help with Windows DNS logs

landen99 — Mon, 19 Mar 2018 21:12:46 GMT

SEDCMD-domainname = s/(\(\d+\))/./g

You had an extra "\" and needed an extra "+"