topic Windows DNS Drop line via nullQueue not working in Getting Data In

Windows DNS Drop line via nullQueue not working

JeremyHagan — Mon, 14 Dec 2015 00:51:35 GMT

I'm trying to drop DNS requests for internal names from our Windows DNS logs. For a guide I am using an answer from this question:
https://answers.splunk.com/answers/35259/best-method-for-pulling-microsoft-dns-logs-with-splunk.html

We have two TLDs I'd like to filter out, for example bob.local and fred.local

I've added the following to my props.conf:

[win_dns]
TRANSFORMS-drop = win_dns_ignorelogs

And the following to my transforms.conf

[win_dns_ignorelogs]
REGEX =(?i)\.*(bob|fred)\.local
DEST_KEY = queue
FORMAT = nullQueue

And restarted Splunk.

One thing to note is that we have a SED command in the props.conf which replaces the standard formatting of the records from something like this:

13/12/2015 9:29:58 AM 0678 PACKET  0000000001FE2D10 TCP Rcv 127.0.0.1       4a3f   Q [0001   D   NOERROR] NS     (8)bob(3)local(0)

To something like this:

13/12/2015 9:29:58 AM 0678 PACKET  0000000001FE2D10 TDP Rcv 127.0.0.1       4a3f   Q [0001   D   NOERROR] NS    bob.local

Via and entry in the props.conf like this:

[source::win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g

When I test the regex in search like this:

sourcetype=win_dns questionName="bob.local" | regex _raw="(?i)\.*(bob|fred)\.local"

It matches the events I am expecting to drop, but the events are still being indexed. Can someone please help me out?

MuS — Mon, 14 Dec 2015 01:57:37 GMT

Hi JeremyHagan,

combine the props.conf into one stanza, because your events will only be parsed once by Splunk. So either do something like this:

[source::win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

[win_dns]
SEDCMD-DNSZones1 = s/\s\(.{1,4}\)// s/\(.{1,4}\)$// s/\(.{1,4}\)/./g
TRANSFORMS-drop = win_dns_ignorelogs

Hope this helps ...

cheers, MuS

JeremyHagan — Mon, 14 Dec 2015 02:43:01 GMT

Ahh, that makes sense. I've made the update and scheduled a restart for tomorrow morning. I'll provide more feedback tomorrow.

MuS — Mon, 14 Dec 2015 02:47:26 GMT

Thanks for the karma, but up voting will not take your karma away 😉 see this https://answers.splunk.com/answers/334246/need-info-about-the-karma-points-system.html for more details

JeremyHagan — Mon, 14 Dec 2015 21:58:37 GMT

I can confirm that this worked. Thanks MuS